[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FZPHZV83RFPXFPYN2QX1KW":3,"skill-same:01M6FZPHZV83RFPXFPYN2QX1KW":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":6,"ownerHtmlUrl":46,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":47,"install":48,"resources":61},"01M6FZPHZV83RFPXFPYN2QX1KW","clawkey",null,"Verifiable human ownership for OpenClaw agents. Register your agent under your human owner via VeryAI palm verification.","kbarbel640-del\u002Fskills","kbarbel640-del","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F255315490?v=4","01M6CJPPQGCCESXMG3K7BBGQ5J","01M6CJPPX2PB2BCZERFVM2C2B3",1,"MIT","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Foyyblin\u002Fclawkey\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[5,23,24,25,26,27,28,29,30,31],"openclaw","identity","verification","https","api","human","register","via","ownership","2026-11-10 10:12:30",false,"---\nname: clawkey\nversion: 1.0.0\ndescription: Verifiable human ownership for OpenClaw agents. Register your agent under your human owner via VeryAI palm verification.\nhomepage: https:\u002F\u002Fclawkey.ai\nmetadata: { \"category\": \"identity\", \"api_base\": \"https:\u002F\u002Fapi.clawkey.ai\u002Fv1\" }\n---\n\n# ClawKey — Verifiable Human Ownership\n\nRegister your agent under your human owner powered by VeryAI palm verification. The agent starts registration with a signed challenge showing it controls its key; the human opens a URL and completes VeryAI's palm verification. Once the human finishes, the agent is registered under their ownership and can be verified by third parties.\n\n> **CRITICAL: Never open browsers**\n>\n> Do **not** use `open`, `xdg-open`, `start`, or any command that opens a browser. Always output the **registration URL** as a text or markdown link for the user to click.\n>\n> - WRONG: `open \"https:\u002F\u002Fapi.very.org\u002Foauth2\u002F...\"`\n> - CORRECT: \"Open this link to complete verification: https:\u002F\u002Fapi.very.org\u002Foauth2\u002F...\"\n\n## Key files\n\n| File         | Purpose                                                                                       |\n| ------------ | --------------------------------------------------------------------------------------------- |\n| SKILL.md     | https:\u002F\u002Fclawkey.ai\u002Fskill.md — registration flow, challenge generation, verification, API      |\n| HEARTBEAT.md | https:\u002F\u002Fclawkey.ai\u002Fheartbeat.md — periodic checklist: skill updates, registration status, etc |\n| Identity     | `~\u002F.openclaw\u002Fidentity\u002Fdevice.json` — OpenClaw deviceId and keys (do not send private key)     |\n\n## Security\n\n- **Private key**: Used to sign the challenge. Never send the private key to ClawKey or any server; only send `publicKey`, `message`, and `signature`.\n- **Registration URL**: Single-use and short-lived. Give it only to the human owner who will complete VeryAI palm verification.\n- **deviceId**: Use a stable identifier (e.g. from your identity store or hash of public key). It ties the agent to the registration and is used for lookup and verification.\n\n## Generating the AgentChallenge\n\nThe **AgentChallenge** is a signed payload that shows you control an Ed25519 key. It has the shape used by standard OpenClaw identity flows: `deviceId`, `publicKey`, `message`, `signature`, `timestamp`. Generate it once and send it to `\u002Fagent\u002Fregister\u002Finit` or `\u002Fagent\u002Fverify\u002Fsignature`.\n\n### Where identity comes from (OpenClaw)\n\nIf you run on OpenClaw, device identity is stored at:\n\n- **Path:** `~\u002F.openclaw\u002Fidentity\u002Fdevice.json`\n\nThat file contains (never send `privateKeyPem` to any server):\n\n| Field           | Use                                                                      |\n| --------------- | ------------------------------------------------------------------------ |\n| `deviceId`      | Use as `deviceId` in the challenge. Stable id for this agent\u002Fdevice.     |\n| `publicKeyPem`  | Use to derive `publicKey` (see below).                                   |\n| `privateKeyPem` | Use only locally to sign the message. **Never include in API requests.** |\n\nIf you don’t use OpenClaw, use your own identity store; ensure you have a stable `deviceId`, an Ed25519 key pair, and that you sign the **exact** string you send as `message`.\n\n### Build the challenge (step-by-step)\n\n1. **Choose the message to sign**  \n   For registration, use a one-time challenge to avoid replay, e.g.:\n   - `clawkey-register-\u003Cunix_timestamp_ms>`  \n     Example: `clawkey-register-1738500000000`  \n     For verify\u002Fsignature, the message is whatever you are proving (e.g. a nonce from a third party).\n\n2. **Sign the message** with your Ed25519 **private** key. The signature must be over the **exact** UTF-8 bytes of `message` (no extra prefix\u002Fsuffix).\n\n3. **Encode for the API:**\n   - **publicKey**: Ed25519 public key in **SPKI DER** form, then **base64** (no PEM wrapper).\n   - **signature**: Raw Ed25519 signature bytes, **base64**.\n   - **timestamp**: Unix time in **milliseconds** when the challenge was created (e.g. `Date.now()`).\n\n4. **JSON body (AgentChallenge):**\n   - `deviceId` — from your identity (e.g. `device.json`)\n   - `publicKey` — base64 DER SPKI\n   - `message` — exact string that was signed\n   - `signature` — base64 signature\n   - `timestamp` — number (ms)\n\n### Example: Node.js\n\n```javascript\nconst crypto = require(\"crypto\");\nconst fs = require(\"fs\");\n\nconst identityPath = `${process.env.HOME}\u002F.openclaw\u002Fidentity\u002Fdevice.json`;\nconst identity = JSON.parse(fs.readFileSync(identityPath, \"utf8\"));\n\nconst message = `clawkey-register-${Date.now()}`;\nconst privateKey = crypto.createPrivateKey(identity.privateKeyPem);\nconst signature = crypto.sign(null, Buffer.from(message, \"utf8\"), privateKey);\n\nconst publicKeyDer = crypto\n  .createPublicKey(identity.publicKeyPem)\n  .export({ type: \"spki\", format: \"der\" });\n\nconst challenge = {\n  deviceId: identity.deviceId,\n  publicKey: publicKeyDer.toString(\"base64\"),\n  message,\n  signature: signature.toString(\"base64\"),\n  timestamp: Date.now(),\n};\n\u002F\u002F POST challenge to https:\u002F\u002Fapi.clawkey.ai\u002Fv1\u002Fagent\u002Fregister\u002Finit\n```\n\n### Using a script\n\nIf you have a script that already produces an AgentChallenge (e.g. signs a message and outputs JSON with `deviceId`, `publicKey`, `message`, `signature`, `timestamp`), you can reuse it for ClawKey:\n\n1. Generate a challenge string, e.g. `clawkey-register-$(date +%s)000` (seconds + \"000\" for ms) or use your script’s convention.\n2. Run the script to sign that message and get the challenge JSON.\n3. POST that JSON to `https:\u002F\u002Fapi.clawkey.ai\u002Fv1\u002Fagent\u002Fregister\u002Finit`.\n\nSame challenge format works for `POST \u002Fagent\u002Fverify\u002Fsignature` when verifying a signature remotely.\n\n## Quick start\n\n### 1. Start registration (agent-initiated)\n\nBuild an **AgentChallenge** as above, then send it to ClawKey to create a session and get a registration URL.\n\n```bash\ncurl -X POST https:\u002F\u002Fapi.clawkey.ai\u002Fv1\u002Fagent\u002Fregister\u002Finit \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"deviceId\": \"my-agent-device-id\",\n    \"publicKey\": \"\u003Cbase64-DER-SPKI-Ed25519>\",\n    \"message\": \"clawkey-register-1738500000000\",\n    \"signature\": \"\u003Cbase64-Ed25519-signature>\",\n    \"timestamp\": 1738500000000\n  }'\n```\n\n**Response (201):**\n\n- `sessionId` — use to poll status\n- `registrationUrl` — **output this as a link for the human; do not open it in a browser**\n- `expiresAt` — session expiry (ISO 8601)\n\nIf the agent is already registered (`deviceId` exists), the API returns **409 Conflict**.\n\n### 2. Human completes verification\n\nTell the human owner to open the `registrationUrl` in their browser. They will go through VeryAI's palm verification via OAuth. When they finish, the agent is registered under their ownership.\n\n### 3. Poll registration status\n\nPoll until the human has completed or the session has expired:\n\n```bash\ncurl \"https:\u002F\u002Fapi.clawkey.ai\u002Fv1\u002Fagent\u002Fregister\u002FSESSION_ID\u002Fstatus\"\n```\n\n**Response:** `status` is one of `pending` | `completed` | `expired` | `failed`. When `status` is `completed`, the response includes `deviceId` and `registration` (e.g. `publicKey`, `registeredAt`).\n\n### 4. Verify signatures or look up an agent\n\n- **Verify a signature** — check that a message was signed by the given key and whether that agent is registered under a verified human:\n\n```bash\ncurl -X POST https:\u002F\u002Fapi.clawkey.ai\u002Fv1\u002Fagent\u002Fverify\u002Fsignature \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"deviceId\": \"...\",\n    \"publicKey\": \"...\",\n    \"message\": \"...\",\n    \"signature\": \"...\",\n    \"timestamp\": 1738500000000\n  }'\n```\n\nResponse: `verified` (signature valid), `registered` (agent under verified human).\n\n- **Look up an agent by device id** — get registration and verification status:\n\n```bash\ncurl \"https:\u002F\u002Fapi.clawkey.ai\u002Fv1\u002Fagent\u002Fverify\u002Fdevice\u002FDEVICE_ID\"\n```\n\nResponse: `registered`, `verified`, and optionally `registeredAt`.\n\n## API reference\n\n**Base URL:** `https:\u002F\u002Fapi.clawkey.ai\u002Fv1`  \n**Local:** `http:\u002F\u002Flocalhost:3000\u002Fv1`\n\n### Endpoints\n\n| Method | Endpoint                             | Auth | Description                                                                      |\n| ------ | ------------------------------------ | ---- | -------------------------------------------------------------------------------- |\n| POST   | `\u002Fagent\u002Fregister\u002Finit`               | None | Start registration session; returns `sessionId`, `registrationUrl`, `expiresAt`. |\n| GET    | `\u002Fagent\u002Fregister\u002F{sessionId}\u002Fstatus` | None | Poll registration status: `pending` \u002F `completed` \u002F `expired` \u002F `failed`.        |\n| POST   | `\u002Fagent\u002Fverify\u002Fsignature`            | None | Verify a signature and whether the agent is registered under a verified human.   |\n| GET    | `\u002Fagent\u002Fverify\u002Fdevice\u002F{deviceId}`    | None | Get agent registration and verification status by device id.                     |\n\n### Request\u002Fresponse schemas\n\n**AgentChallenge** (used in register\u002Finit and verify\u002Fsignature):\n\n| Field     | Type   | Required | Description                                              |\n| --------- | ------ | -------- | -------------------------------------------------------- |\n| deviceId  | string | yes      | Key\u002Fdevice id (e.g. public key hash or app id).          |\n| publicKey | string | yes      | Ed25519 public key, base64 DER SPKI.                     |\n| message   | string | yes      | Exact message that was signed (e.g. challenge or nonce). |\n| signature | string | yes      | Ed25519 signature over message, base64.                  |\n| timestamp | int64  | yes      | Unix timestamp (ms) when the challenge was created.      |\n\n**Register init response (201):**\n\n```json\n{\n  \"sessionId\": \"uuid\",\n  \"registrationUrl\": \"https:\u002F\u002Fclawkey.ai\u002Fregister\u002F...\",\n  \"expiresAt\": \"2026-02-02T12:00:00Z\"\n}\n```\n\n**Register status response (200):**\n\n```json\n{\n  \"status\": \"completed\",\n  \"deviceId\": \"my-agent-device-id\",\n  \"registration\": {\n    \"publicKey\": \"...\",\n    \"registeredAt\": \"2026-02-02T12:00:00Z\"\n  }\n}\n```\n\n**Verify signature response (200):**\n\n```json\n{\n  \"verified\": true,\n  \"registered\": true\n}\n```\n\n**Device status response (200):**\n\n```json\n{\n  \"registered\": true,\n  \"verified\": true,\n  \"registeredAt\": \"2026-02-02T12:00:00Z\"\n}\n```\n\n**Error (4xx\u002F5xx):**\n\n```json\n{\n  \"error\": \"Human-readable message\",\n  \"code\": \"optional_code\",\n  \"details\": {}\n}\n```\n\n### Error codes\n\n| Code | Meaning                                              |\n| ---- | ---------------------------------------------------- |\n| 400  | Bad request (invalid or missing fields).             |\n| 404  | Session or device not found.                         |\n| 409  | Agent already registered (device_id already exists). |\n| 500  | Server error.                                        |\n\n## What this proves\n\nAfter registration and VeryAI verification:\n\n- **Human ownership** — The agent is bound to a human who passed palm verification.\n- **Key binding** — Ed25519 signatures prove the agent controls the key; ClawKey ties that key to the verified human.\n- **Public verification** — Third parties can call `\u002Fagent\u002Fverify\u002Fsignature` or `\u002Fagent\u002Fverify\u002Fdevice\u002F{deviceId}` to confirm an agent is registered and verified.\n\n## When to use this skill\n\n- Registering an OpenClaw (or other) agent under a human owner.\n- Proving to a third party that an agent is owned by a verified human (e.g. before granting access or privileges).\n- Checking whether a given key or device is registered and verified.\n\n## Need help?\n\n- API base: https:\u002F\u002Fapi.clawkey.ai\u002Fv1\n- Homepage: https:\u002F\u002Fclawkey.ai\n","# ClawKey — Verifiable Human Ownership\n\nRegister your agent under your human owner powered by VeryAI palm verification. The agent starts registration with a signed challenge showing it controls its key; the human opens a URL and completes VeryAI's palm verification. Once the human finishes, the agent is registered under their ownership and can be verified by third parties.\n\n> **CRITICAL: Never open browsers**\n>\n> Do **not** use `open`, `xdg-open`, `start`, or any command that opens a browser. Always output the **registration URL** as a text or markdown link for the user to click.\n>\n> - WRONG: `open \"https:\u002F\u002Fapi.very.org\u002Foauth2\u002F...\"`\n> - CORRECT: \"Open this link to complete verification: https:\u002F\u002Fapi.very.org\u002Foauth2\u002F...\"\n\n## Key files\n\n| File         | Purpose                                                                                       |\n| ------------ | --------------------------------------------------------------------------------------------- |\n| SKILL.md     | https:\u002F\u002Fclawkey.ai\u002Fskill.md — registration flow, challenge generation, verification, API      |\n| HEARTBEAT.md | https:\u002F\u002Fclawkey.ai\u002Fheartbeat.md — periodic checklist: skill updates, registration status, etc |\n| Identity     | `~\u002F.openclaw\u002Fidentity\u002Fdevice.json` — OpenClaw deviceId and keys (do not send private key)     |\n\n## Security\n\n- **Private key**: Used to sign the challenge. Never send the private key to ClawKey or any server; only send `publicKey`, `message`, and `signature`.\n- **Registration URL**: Single-use and short-lived. Give it only to the human owner who will complete VeryAI palm verification.\n- **deviceId**: Use a stable identifier (e.g. from your identity store or hash of public key). It ties the agent to the registration and is used for lookup and verification.\n\n## Generating the AgentChallenge\n\nThe **AgentChallenge** is a signed payload that shows you control an Ed25519 key. It has the shape used by standard OpenClaw identity flows: `deviceId`, `publicKey`, `message`, `signature`, `timestamp`. Generate it once and send it to `\u002Fagent\u002Fregister\u002Finit` or `\u002Fagent\u002Fverify\u002Fsignature`.\n\n### Where identity comes from (OpenClaw)\n\nIf you run on OpenClaw, device identity is stored at:\n\n- **Path:** `~\u002F.openclaw\u002Fidentity\u002Fdevice.json`\n\nThat file contains (never send `privateKeyPem` to any server):\n\n| Field           | Use                                                                      |\n| --------------- | ------------------------------------------------------------------------ |\n| `deviceId`      | Use as `deviceId` in the challenge. Stable id for this agent\u002Fdevice.     |\n| `publicKeyPem`  | Use to derive `publicKey` (see below).                                   |\n| `privateKeyPem` | Use only locally to sign the message. **Never include in API requests.** |\n\nIf you don’t use OpenClaw, use your own identity store; ensure you have a stable `deviceId`, an Ed25519 key pair, and that you sign the **exact** string you send as `message`.\n\n### Build the challenge (step-by-step)\n\n1. **Choose the message to sign**  \n   For registration, use a one-time challenge to avoid replay, e.g.:\n   - `clawkey-register-\u003Cunix_timestamp_ms>`  \n     Example: `clawkey-register-1738500000000`  \n     For verify\u002Fsignature, the message is whatever you are proving (e.g. a nonce from a third party).\n\n2. **Sign the message** with your Ed25519 **private** key. The signature must be over the **exact** UTF-8 bytes of `message` (no extra prefix\u002Fsuffix).\n\n3. **Encode for the API:**\n   - **publicKey**: Ed25519 public key in **SPKI DER** form, then **base64** (no PEM wrapper).\n   - **signature**: Raw Ed25519 signature bytes, **base64**.\n   - **timestamp**: Unix time in **milliseconds** when the challenge was created (e.g. `Date.now()`).\n\n4. **JSON body (AgentChallenge):**\n   - `deviceId` — from your identity (e.g. `device.json`)\n   - `publicKey` — base64 DER SPKI\n   - `message` — exact string that was signed\n   - `signature` — base64 signature\n   - `timestamp` — number (ms)\n\n### Example: Node.js\n\n```javascript\nconst crypto = require(\"crypto\");\nconst fs = require(\"fs\");\n\nconst identityPath = `${process.env.HOME}\u002F.openclaw\u002Fidentity\u002Fdevice.json`;\nconst identity = JSON.parse(fs.readFileSync(identityPath, \"utf8\"));\n\nconst message = `clawkey-register-${Date.now()}`;\nconst privateKey = crypto.createPrivateKey(identity.privateKeyPem);\nconst signature = crypto.sign(null, Buffer.from(message, \"utf8\"), privateKey);\n\nconst publicKeyDer = crypto\n  .createPublicKey(identity.publicKeyPem)\n  .export({ type: \"spki\", format: \"der\" });\n\nconst challenge = {\n  deviceId: identity.deviceId,\n  publicKey: publicKeyDer.toString(\"base64\"),\n  message,\n  signature: signature.toString(\"base64\"),\n  timestamp: Date.now(),\n};\n\u002F\u002F POST challenge to https:\u002F\u002Fapi.clawkey.ai\u002Fv1\u002Fagent\u002Fregister\u002Finit\n```\n\n### Using a script\n\nIf you have a script that already produces an AgentChallenge (e.g. signs a message and outputs JSON with `deviceId`, `publicKey`, `message`, `signature`, `timestamp`), you can reuse it for ClawKey:\n\n1. Generate a challenge string, e.g. `clawkey-register-$(date +%s)000` (seconds + \"000\" for ms) or use your script’s convention.\n2. Run the script to sign that message and get the challenge JSON.\n3. POST that JSON to `https:\u002F\u002Fapi.clawkey.ai\u002Fv1\u002Fagent\u002Fregister\u002Finit`.\n\nSame challenge format works for `POST \u002Fagent\u002Fverify\u002Fsignature` when verifying a signature remotely.\n\n## Quick start\n\n### 1. Start registration (agent-initiated)\n\nBuild an **AgentChallenge** as above, then send it to ClawKey to create a session and get a registration URL.\n\n```bash\ncurl -X POST https:\u002F\u002Fapi.clawkey.ai\u002Fv1\u002Fagent\u002Fregister\u002Finit \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"deviceId\": \"my-agent-device-id\",\n    \"publicKey\": \"\u003Cbase64-DER-SPKI-Ed25519>\",\n    \"message\": \"clawkey-register-1738500000000\",\n    \"signature\": \"\u003Cbase64-Ed25519-signature>\",\n    \"timestamp\": 1738500000000\n  }'\n```\n\n**Response (201):**\n\n- `sessionId` — use to poll status\n- `registrationUrl` — **output this as a link for the human; do not open it in a browser**\n- `expiresAt` — session expiry (ISO 8601)\n\nIf the agent is already registered (`deviceId` exists), the API returns **409 Conflict**.\n\n### 2. Human completes verification\n\nTell the human owner to open the `registrationUrl` in their browser. They will go through VeryAI's palm verification via OAuth. When they finish, the agent is registered under their ownership.\n\n### 3. Poll registration status\n\nPoll until the human has completed or the session has expired:\n\n```bash\ncurl \"https:\u002F\u002Fapi.clawkey.ai\u002Fv1\u002Fagent\u002Fregister\u002FSESSION_ID\u002Fstatus\"\n```\n\n**Response:** `status` is one of `pending` | `completed` | `expired` | `failed`. When `status` is `completed`, the response includes `deviceId` and `registration` (e.g. `publicKey`, `registeredAt`).\n\n### 4. Verify signatures or look up an agent\n\n- **Verify a signature** — check that a message was signed by the given key and whether that agent is registered under a verified human:\n\n```bash\ncurl -X POST https:\u002F\u002Fapi.clawkey.ai\u002Fv1\u002Fagent\u002Fverify\u002Fsignature \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"deviceId\": \"...\",\n    \"publicKey\": \"...\",\n    \"message\": \"...\",\n    \"signature\": \"...\",\n    \"timestamp\": 1738500000000\n  }'\n```\n\nResponse: `verified` (signature valid), `registered` (agent under verified human).\n\n- **Look up an agent by device id** — get registration and verification status:\n\n```bash\ncurl \"https:\u002F\u002Fapi.clawkey.ai\u002Fv1\u002Fagent\u002Fverify\u002Fdevice\u002FDEVICE_ID\"\n```\n\nResponse: `registered`, `verified`, and optionally `registeredAt`.\n\n## API reference\n\n**Base URL:** `https:\u002F\u002Fapi.clawkey.ai\u002Fv1`  \n**Local:** `http:\u002F\u002Flocalhost:3000\u002Fv1`\n\n### Endpoints\n\n| Method | Endpoint                             | Auth | Description                                                                      |\n| ------ | ------------------------------------ | ---- | -------------------------------------------------------------------------------- |\n| POST   | `\u002Fagent\u002Fregister\u002Finit`               | None | Start registration session; returns `sessionId`, `registrationUrl`, `expiresAt`. |\n| GET    | `\u002Fagent\u002Fregister\u002F{sessionId}\u002Fstatus` | None | Poll registration status: `pending` \u002F `completed` \u002F `expired` \u002F `failed`.        |\n| POST   | `\u002Fagent\u002Fverify\u002Fsignature`            | None | Verify a signature and whether the agent is registered under a verified human.   |\n| GET    | `\u002Fagent\u002Fverify\u002Fdevice\u002F{deviceId}`    | None | Get agent registration and verification status by device id.                     |\n\n### Request\u002Fresponse schemas\n\n**AgentChallenge** (used in register\u002Finit and verify\u002Fsignature):\n\n| Field     | Type   | Required | Description                                              |\n| --------- | ------ | -------- | -------------------------------------------------------- |\n| deviceId  | string | yes      | Key\u002Fdevice id (e.g. public key hash or app id).          |\n| publicKey | string | yes      | Ed25519 public key, base64 DER SPKI.                     |\n| message   | string | yes      | Exact message that was signed (e.g. challenge or nonce). |\n| signature | string | yes      | Ed25519 signature over message, base64.                  |\n| timestamp | int64  | yes      | Unix timestamp (ms) when the challenge was created.      |\n\n**Register init response (201):**\n\n```json\n{\n  \"sessionId\": \"uuid\",\n  \"registrationUrl\": \"https:\u002F\u002Fclawkey.ai\u002Fregister\u002F...\",\n  \"expiresAt\": \"2026-02-02T12:00:00Z\"\n}\n```\n\n**Register status response (200):**\n\n```json\n{\n  \"status\": \"completed\",\n  \"deviceId\": \"my-agent-device-id\",\n  \"registration\": {\n    \"publicKey\": \"...\",\n    \"registeredAt\": \"2026-02-02T12:00:00Z\"\n  }\n}\n```\n\n**Verify signature response (200):**\n\n```json\n{\n  \"verified\": true,\n  \"registered\": true\n}\n```\n\n**Device status response (200):**\n\n```json\n{\n  \"registered\": true,\n  \"verified\": true,\n  \"registeredAt\": \"2026-02-02T12:00:00Z\"\n}\n```\n\n**Error (4xx\u002F5xx):**\n\n```json\n{\n  \"error\": \"Human-readable message\",\n  \"code\": \"optional_code\",\n  \"details\": {}\n}\n```\n\n### Error codes\n\n| Code | Meaning                                              |\n| ---- | ---------------------------------------------------- |\n| 400  | Bad request (invalid or missing fields).             |\n| 404  | Session or device not found.                         |\n| 409  | Agent already registered (device_id already exists). |\n| 500  | Server error.                                        |\n\n## What this proves\n\nAfter registration and VeryAI verification:\n\n- **Human ownership** — The agent is bound to a human who passed palm verification.\n- **Key binding** — Ed25519 signatures prove the agent controls the key; ClawKey ties that key to the verified human.\n- **Public verification** — Third parties can call `\u002Fagent\u002Fverify\u002Fsignature` or `\u002Fagent\u002Fverify\u002Fdevice\u002F{deviceId}` to confirm an agent is registered and verified.\n\n## When to use this skill\n\n- Registering an OpenClaw (or other) agent under a human owner.\n- Proving to a third party that an agent is owned by a verified human (e.g. before granting access or privileges).\n- Checking whether a given key or device is registered and verified.\n\n## Need help?\n\n- API base: https:\u002F\u002Fapi.clawkey.ai\u002Fv1\n- Homepage: https:\u002F\u002Fclawkey.ai\n",{"name":5,"version":37,"homepage":38,"metadata":39,"description":7},"1.0.0","https:\u002F\u002Fclawkey.ai",{"api_base":40,"category":24},"https:\u002F\u002Fapi.clawkey.ai\u002Fv1","main","e7e336ac628c3e3bd771aff1aaa469c93778f94a","skills\u002Foyyblin\u002Fclawkey",0,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del","2026-08-23 22:39:37",{"source":8,"skillName":5,"commands":49,"prompt":59,"zipAvailable":60},[50,53,56],{"tool":51,"command":52},"npx","npx skills add kbarbel640-del\u002Fskills --skill clawkey",{"tool":54,"command":55},"bunx","bunx skills add kbarbel640-del\u002Fskills --skill clawkey",{"tool":57,"command":58},"pnpm","pnpm dlx skills add kbarbel640-del\u002Fskills --skill clawkey","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Foyyblin\u002Fclawkey\u002FSKILL.md",true,[62,68,72],{"path":63,"resourceType":64,"resourceTypeDesc":65,"sizeBytes":66,"sourceHtmlUrl":67},"_meta.json","REFERENCE","参考文档",267,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Foyyblin\u002Fclawkey\u002F_meta.json",{"path":69,"resourceType":64,"resourceTypeDesc":65,"sizeBytes":70,"sourceHtmlUrl":71},"HEARTBEAT.md",3563,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Foyyblin\u002Fclawkey\u002FHEARTBEAT.md",{"path":73,"resourceType":64,"resourceTypeDesc":65,"sizeBytes":74,"sourceHtmlUrl":75},"README.md",69,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Foyyblin\u002Fclawkey\u002FREADME.md",[77,106,130,150,156,176],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":88,"publishedAt":32},"01M6G8J55967D6281ACMKAKTEQ","crowd-prompting","A marketplace where AI agents improve prompts, system instructions, tool descriptions, and other text-based content with domain expertise from real-world operations — and earn tokens for valuable contributions.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzzadrian\u002Fcrowd-prompting\u002FSKILL.md",[83],{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[89,90,27,91,92,93,94,95,96,97,98,99,100,101,102,103,26,104,105],"crowd prompting","prompting","with","tokens","domain","world","prompts","operations","instructions","text","tool","system","improve","productivity","marketplace","content","ai agents",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":113,"publishedAt":32},"01M6G8J0PKPAYVET6BWE8W4C26","dilemm-ai","Compete in DilemmAI, the prisoner's dilemma AI arena at dilemm.ai. Use when an OpenClaw agent wants to create an account, design and submit strategy prompts for their bot, enter matchmaking, analyze historical matches and leaderboards, and iterate on bot strategy. Requires headless browser automation (no API available yet).","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzyori\u002Fdilemm-ai\u002FSKILL.md",[112],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[114,27,115,116,117,118,119,120,121,122,23,123,124,125,126,127,128,95,129],"dilemm ai","arena","analyze","browser","openclaw agent","create","automation","browser automation","bot","design","strategy","headless","compete","submit","matchmaking","use",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":139,"publishedAt":32},"01M6G8HWAF3K9SW7NP3Z83CPJ6","arxiv-paper-reviews","Interact with arXiv Crawler API to fetch papers, read reviews, and submit comments. Use when working with arXiv papers, fetching paper lists by date\u002Fcategory\u002Finterest, viewing paper details with comments, or submitting paper reviews via API at http:\u002F\u002F150.158.152.82:8000.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzxrys\u002Fweak-accept\u002FSKILL.md",[136],{"categoryNo":137,"categoryName":138,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000021","资料检索与研究",[140,141,142,143,144,145,146,91,147,127,129,148,27,149,30],"arxiv paper reviews","reviews","arxiv","paper","crawler","papers","comments","fetch","read","http",{"skillNo":151,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":155,"publishedAt":32},"01M6G8HQJ7N7WMY6YV7D7SSJ16","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzxrys\u002Farxiv-paper-reviews\u002FSKILL.md",[154],{"categoryNo":137,"categoryName":138,"taxonomyType":20,"taxonomyTypeDesc":21},[143,142,141,140,30,145,146,91,144,127,129,147,148,27,149],{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":32},"01M6G8HM95Y64JNVFC2HN4E2BG","git-summary","Get a quick summary of the current Git repository including status, recent commits, branches, and contributors.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzweack\u002Fgit-summary\u002FSKILL.md",[],[163,164,165,166,167,168,169,170,171,172,173,174,175],"git","summary","git summary","commits","repository","win32","status","linux","contributors","true","quick","get","branches",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":186,"publishedAt":32},"01M6G8HGEGF05CNEJCGVYFSC4R","agent-constitution","Interact with AgentConstitution governance contracts on Base Sepolia. Check compliance, read rules, log actions, query governance state.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fztsalexey\u002Fagent-constitution\u002FSKILL.md",[182,183],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":184,"categoryName":185,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000037","律师与法务",[187,188,189,190,91,191,192,41,193,148,194,195,196,197,198,26,199,200,201],"agent constitution","constitution","contracts","tree","query","base","log","check","Rules","projects","compliance","actions","state","governance","github"]