0G SkillGate

0G SkillGate is a focused ETHGlobal Open Agents hackathon project: a TypeScript CLI plus a tiny dashboard that audits SKILL.md files before an agent installs them.

Project Pitch

Agent skills are powerful because they are easy to share, but that makes them an attractive attack surface. A malicious SKILL.md can instruct an agent to read keys, download remote code, delete files, or exfiltrate secrets. SkillGate puts a narrow audit checkpoint in front of installation so agents can refuse unsafe skills with evidence.

Why This Is Useful for OpenClaw and Similar Agent Frameworks

• Skills are usually plain text and portable, which makes them easy to inspect statically.
• A deterministic scanner catches obvious high-risk behaviors before tool execution.
• An optional model review adds a second opinion without blocking offline demos.
• Storage and chain publication create portable evidence that another agent or UI can verify.
• The decision surface stays tight: allow, review, or block.

Setup

npm install

Optional env vars for 0G integrations:

ZG_SERVICE_URL=
ZG_API_SECRET=
ZG_MODEL=qwen/qwen-2.5-7b-instruct

PRIVATE_KEY=
ZG_STORAGE_RPC=https://evmrpc-testnet.0g.ai
ZG_STORAGE_INDEXER=https://indexer-storage-testnet-turbo.0g.ai
ZG_CHAIN_RPC=https://evmrpc-testnet.0g.ai
AUDIT_REGISTRY_ADDRESS=

Demo Commands

npm run skillgate -- scan examples/skills/benign/SKILL.md
npm run skillgate -- scan examples/skills/risky/SKILL.md
MOCK_0G=true npm run skillgate -- scan examples/skills/risky/SKILL.md --with-compute --publish
npm run agent:demo -- examples/skills/risky/SKILL.md
npm run deploy:0g
npm run dashboard

0G Protocol Features Used

• 0G Compute through an OpenAI-compatible API using the openai package.
• 0G Storage publishing through @0gfoundation/0g-ts-sdk.
• 0G Chain evidence anchoring through a Hardhat-deployed AuditRegistry contract.

Contract Deployment Address

0G Galileo AuditRegistry: 0x2aA6129a557224Faf7eC238e884fc8812718F8E0

Explorer: https://chainscan-galileo.0g.ai/address/0x2aA6129a557224Faf7eC238e884fc8812718F8E0

After deployment, scripts/deploy.ts writes the deployed address to web/reports/registry.json, and the CLI/agent will reuse it automatically.

Architecture Diagram

Architecture notes and Mermaid diagram

Example Agent

examples/agents/skillgate-agent.ts is a simple agent-side gate. It audits a proposed skill, prints the reasons behind the verdict, shows local or storage evidence, and decides whether to install, require review, or deny the skill.

Submission Checklist

• TypeScript CLI for skill auditing
• Deterministic static scanner
• Optional 0G Compute reviewer with deterministic mock fallback
• JSON audit report generation
• 0G Storage publish path with local fallback
• 0G Chain AuditRegistry contract and deploy script
• Working example agent that allow/blocks a skill
• Tiny dashboard for the latest report
• Architecture and submission docs