How should ✅ AgentVerif — Scan. Sign. Verify. Control your distribution. be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

✅ AgentVerif — Scan. Sign. Verify. Control your distribution.

SCAN → SIGN → VERIFY. Certify your skill, detect tampering, revoke instantly. Full control over how your skill is distributed and run. Requires AGENTVERIF_AP...

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

997

Updated

Oct 11, 2026

Version

2.0.6

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 997 downloads reported by the source. Last updated 10/11/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 11, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 11, 2026
Adoption signal: 997 downloadsadoption · observed Oct 11, 2026
Latest release: 2.0.6release · observed Apr 22, 2026
Handshake status: UNKNOWNsecurity

What changed

Newest first. Only changes that point at a source are listed.

Release 2.0.6release
Badge at top of skill page + upgraded billboard with certified score and license ID
Observed Apr 22, 2026 · source

Install and run

Setup complexity: low.

clawhub skill install s174z6r672gxnt8rsmsmknd03d8469nb:agentverif

Install using `clawhub skill install s174z6r672gxnt8rsmsmknd03d8469nb:agentverif` in an isolated environment before connecting it to live workloads.
No published capability contract is available yet, so validate auth and request/response behavior manually.
Review the upstream CLAWHUB listing at https://clawhub.ai/shaymizuno/agentverif before using production credentials.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-shaymizuno-agentverif/snapshot"

Run-check

$0.02 USD

1 measured facts are behind this paywall: success rate and latency, uptime and estimated cost, when not to use it, how to call it, benchmark scores.

Agents pay $0.02 in USDC. A card payment is $0.50, the smallest a card allows.

Documentation

CLAWHUB

73,547 characters of source documentation, loaded on request.

Extracted files

5 files captured from the source.

SKILL.md

---
name: agentverif
description: "SCAN → SIGN → VERIFY. Certify your skill, detect tampering, revoke instantly. Full control over how your skill is distributed and run. Requires AGENTVERIF_API_KEY for revoke."
homepage: https://agentverif.com
user-invocable: true
metadata: {
  "openclaw": {
    "emoji": "✅",
    "badge": "✅ AgentVerif Certified",
    "requires": { "anyBins": ["python3", "python"] }
  }
}
---

# ✅ AgentVerif — OWASP Scan + Cryptographic Verification

---
✅ AgentVerif Certified
⭐ Score: 100/100 · 🔑 AC-FA10-EB04
clawhub.ai/agentverif
---

**AgentVerif** is the trust layer for OpenClaw skills.
Every skill you install or distribute is scanned against the
OWASP LLM Top 10 and cryptographically verified —
so you know it's authentic, unmodified, and safe to run.

The former **AgentCop Sentinel** is now **AgentVerif** —
same battle-tested OWASP scanner, now with cryptographic
signing, tamper detection, and license revocation built in.

Install in one line:
```
npx clawhub@latest install agentverif
```

**Requires agentverif-sign (install once):**
```
pip install agentverif-sign
```
This skill never installs packages automatically.
You stay in control of your environment.

---

## What AgentVerif does

| Layer | What it catches | OWASP |
|-------|----------------|-------|
| **SCAN** | Prompt injection, credential leaks, insecure output, tool-call injection | LLM01, LLM02, LLM06, LLM08 |
| **SIGN** | Cryptographic hash + License ID — proves the skill is yours | — |
| **VERIFY** | Tamper detection — catches modified versions before execution | — |
| **REVOKE** | Kill a license instantly if the skill gets redistributed | — |

---

## Slash commands

### /security scan [--last 1h|24h|7d] [--since ISO]
Scan current session for OWASP LLM Top 10 violations.
Score 0–100. Below 70 = refused. Shows exact violations + fixes.

### /security verify <license_id_or_zip>
Verify a skill certificate against the agentverif.com registry.
Returns: VERIFIED / TAMPERED / UNSIGNED / EXPIRED / REVOKED

### /security sign <zip_path>
Sign a skill ZIP. OWASP scan runs first (score ≥ 70 required).
Injects SIGNATURE.json. Issues a License ID.

### /security revoke <license_id>
Revoke a license. Verification fails immediately for all buyers.
Requires AGENTVERIF_API_KEY environment variable.

### /security status
Reports that this skill is stateless — no local session data stored.
Run `/security scan` to get a live score.

### /security report
Full violation report grouped by severity (CRITICAL → ERROR → WARN).
Reads from stdin — pipe session context or text to scan.

### /security taint-check <text>
Check a string for LLM01 prompt injection. Exit 1 if tainted.

### /security output-check <text>
Check agent output for LLM02 insecure patterns.

### /security diff <session1> <session2>
Not supported — this skill is stateless and stores no session history.

### /security badge
Get your ✅ AgentVerif Certified badge for your skill listing.

---

## Privacy & data

**Network

README.md

# 🛡️ AgentVerif — OpenClaw Skill

OWASP LLM Top 10 scanner + cryptographic verification for every skill you install or distribute.

Install in one line:

```bash
npx clawhub@latest install agentverif
```

**Requires agentverif-sign (install once):**

```bash
pip install agentverif-sign
```

This skill never installs packages automatically. You stay in control of your environment.

---

## Commands

| Command | What it does |
|---------|-------------|
| `/security scan` | Scan current session for OWASP LLM Top 10 violations (score 0–100) |
| `/security verify <license_id_or_zip>` | Verify a skill certificate — VERIFIED / TAMPERED / UNSIGNED / REVOKED |
| `/security sign <zip_path>` | Sign a skill ZIP (OWASP scan runs first, score ≥ 70 required) |
| `/security revoke <license_id>` | Revoke a license instantly (requires AGENTVERIF_API_KEY) |
| `/security status` | Agent trust score, active violations, session fingerprint |
| `/security report` | Full violation report grouped by severity |
| `/security taint-check <text>` | Check a string for LLM01 prompt injection |
| `/security output-check <text>` | Check agent output for LLM02 insecure patterns |
| `/security diff <session1> <session2>` | Compare two scan sessions for regressions |
| `/security badge` | Get your ✅ AgentVerif Certified badge |

---

## OWASP Coverage

| Layer | What it catches | OWASP |
|-------|----------------|-------|
| **SCAN** | Prompt injection, credential leaks, insecure output, tool-call injection | LLM01, LLM02, LLM06, LLM08 |
| **SIGN** | Cryptographic hash + License ID | — |
| **VERIFY** | Tamper detection before execution | — |
| **REVOKE** | Kill a license instantly | — |

---

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Clean — no violations, certificate valid |
| 1 | Violations detected or certificate invalid |
| 2 | Error — agentverif-sign not installed or bad arguments |

---

## Requirements

- OpenClaw ≥ 0.1
- Python ≥ 3.11
- `agentverif-sign >= 0.2.0`: `pip install agentverif-sign`

---

Built by [agentverif.com](https://agentverif.com)

_meta.json

{
  "ownerId": "kn74kv6cjp1hk19qg6w8cet8xs84776n",
  "slug": "agentverif",
  "version": "2.0.6",
  "publishedAt": 1776872916417
}

skill-card.md

## Description:

AgentVerif scans skill content for OWASP LLM risks, signs skill ZIPs, verifies skill certificates, and supports license revocation for controlled distribution.

This skill is ready for commercial/non-commercial use.

## Publisher:

[shaymizuno](https://clawhub.ai/user/shaymizuno)

### License/Terms of Use:

MIT-0

## Use Case:

Developers and skill publishers use AgentVerif to scan OpenClaw skills for common LLM security issues, sign distributable ZIP archives, verify certificates, and revoke licenses when distribution must be controlled.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: Skill archives can be uploaded to the configured AgentVerif endpoint during scan or sign operations.

Mitigation: Review archive contents first and do not submit ZIPs containing secrets, credentials, or proprietary material unless sharing them with that endpoint is acceptable.

Risk: The sign command can modify ZIP files in place.

Mitigation: Keep a backup copy of the original archive before signing.

Risk: Fixed certification text may overstate assurance if users treat it as a fresh scan result.

Mitigation: Verify the release and review current scan output before relying on certification claims.

Risk: Unpinned installer or dependency versions can change behavior after installation.

Mitigation: Use pinned versions for the ClawHub installer and the agentverif-sign dependency in controlled environments.

## Reference(s):

- [ClawHub skill listing](https://clawhub.ai/shaymizuno/skills/agentverif)
- [Publisher profile](https://clawhub.ai/user/shaymizuno)
- [AgentVerif homepage](https://agentverif.com)
- [AgentVerif documentation](https://agentverif.com/docs)

## Skill Output:

**Output Type(s):** [text, markdown, JSON, shell commands, configuration, guidance]

**Output Format:** [JSON and text responses with optional Markdown badge output and shell command guidance]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [Commands return process exit codes for pass, fail, and argument or dependency errors.]

## Skill Version(s):

2.0.6 (source: server release evidence)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

package.json

{
  "name": "openclaw-skill-agentverif",
  "version": "2.0.1",
  "description": "✅ SCAN → SIGN → VERIFY. Certify your skill, detect tampering, revoke instantly. Full control over how your skill is distributed and run.",
  "homepage": "https://agentverif.com",
  "license": "MIT",
  "openclaw": {
    "type": "skill",
    "slug": "agentverif",
    "entry": "skill.py",
    "python-package": "agentverif-sign>=0.2.0",
    "requires": {
      "anyBins": ["python3", "python"]
    },
    "emoji": "✅",
    "badge": "✅ AgentVerif Certified",
    "env": {
      "AGENTVERIF_API_KEY": {
        "required": false,
        "description": "Required only for the revoke command."
      }
    },
    "commands": [
      "scan",
      "verify",
      "sign",
      "revoke",
      "status",
      "report",
      "taint-check",
      "output-check",
      "diff",
      "badge"
    ]
  },
  "repository": {
    "type": "git",
    "url": "https://github.com/trusthandoff/agentverif"
  }
}

Github ReposUpdated 3d agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW

Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular