SafeLink

Production-grade OpenClaw skill for safe bidirectional hire-agent and execute-agent flows.

Brand and Discovery

INLINECODE0 is designed for trusted agent economies:

• - tagline: INLINECODE1
• target users: OpenClaw developers, MCP operators, agent marketplaces
• recommended ClawHub tags:

- security - web3 - a2a - payments - escrow - x402 - erc-8004 - agentic-wallet - mcp - INLINECODE11

Design Goals

• - Default-safe operations with explicit escalation for risk.
• Zero private key exposure through MPC wallet providers.
• Proof-before-settlement: no proof, no release.
• Deterministic validation and replay defenses.
• Fast onboarding: one-call wallet setup and beginner-safe examples.

Security Guarantees

SafeLink enforces the following guarantees in runtime code paths:

1. 1. Wallet custody

• - Private keys are never loaded into app memory.
• Signing is delegated to Coinbase AgentKit MPC or Privy MPC.

1. 2. Settlement safety

• - Escrow deposit happens before task execution.
• Release requires proof hash equality with on-chain commitment.
• Failed delivery and invalid proofs trigger refund path.

1. 3. Replay and race protection

• - Receipt replay reservation/used state is enforced.
• Idempotency lock prevents concurrent duplicates.
• Completed idempotency keys are blocked for reuse (terminal dedupe window).

1. 4. Input and endpoint hardening

• - Strict zod validation on tool inputs.
• PII redaction for task and intent text.
• Endpoint URL checks include scheme, hostname denylist, private IP range checks, and DNS resolution checks to prevent SSRF pivots.

1. 5. Transaction execution safety

• - Simulate before signing.
• Risk score and flags decide gating path.
• High-risk actions require explicit confirmation.

Industry Alignment Matrix

Reference themes: x402 v2 facilitator model, ERC-8004 reputation/verification tiers, proof-before-settlement, cryptoeconomic reputation, opaque A2A execution, gas-aware risk controls, zkML/TEE extensibility.

• - x402 facilitator flow: INLINECODE12

- covered: requirements/pay/verify flows, domain checks, timeout handling - gap: SIWx auth binding, batch settlement primitive, sponsored gas ergonomics

• - ERC-8004 base identity/reputation: INLINECODE13

- covered: register, getAgent, active checks, threshold gating - gap: tiered verification fields and verifier lifecycle

• - Proof-before-settlement: INLINECODE14

- covered: deterministic proof commitment and strict on-chain proof match

• - Reputation cryptoeconomics: INLINECODE15

- covered: escrow success/failure reputation updates, minimum threshold checks - gap: robust Sybil graph scoring, stake/slash challenge economics

• - A2A opaque execution: INLINECODE16

- covered: minimal metadata task payload and policy gates - gap: encrypted envelope mode and selective disclosure controls

• - Gas and DoS hardening: INLINECODE17

- covered: simulation gas checks, request body limits, concurrency cap, timeout controls - gap: adaptive rate control, weighted queues, quota market controls

• - zkML/TEE hooks: INLINECODE18

- covered: tool fields and hook placeholders - gap: real attestation verification and circuit verifier integration

Tool Contract (Production)

setup_agentic_wallet

Purpose: Create or load an MPC wallet and return balance/network readiness.

Parameters:

• - provider (optional): INLINECODE21

- auto: choose Coinbase when available, else Privy

Returns:

CODEBLOCK0

Safety notes:

• - Never return secrets.
• If user selects a provider explicitly, honor that choice.
• Fail with actionable configuration guidance.

Example:

CODEBLOCK1

safe_hire_agent

Purpose: Hire one agent with escrow + x402 + proof verification.

Parameters:

• - target_id: 0x... agent address
• INLINECODE26: text task
• INLINECODE27: INLINECODE28
• INLINECODE29: number USDC
• INLINECODE30 (optional): dedupe key
• INLINECODE31 (optional): runtime constraints
• INLINECODE32 (optional): explicit high-risk confirmation

Returns:

CODEBLOCK2

Safety notes:

• - Blocks low-reputation targets.
• Enforces strict endpoint validation including DNS/IP checks.
• Refuses invalid proofs and refunds escrow.

Example:

CODEBLOCK3

safe_execute_tx

Purpose: Intent-to-transaction execution pipeline with mandatory simulation and risk gating.

Parameters:

• - intent_description: plain-English tx intent
• INLINECODE35 (optional): high-risk confirmation

Returns:

CODEBLOCK4

Safety notes:

• - Never sign when simulation fails.
• Never bypass confirmation for high-risk score.

Example:

CODEBLOCK5

safe_listen_for_hire

Purpose: Start local HTTP receiver for inbound paid tasks.

Parameters:

• - none

Returns:

CODEBLOCK6

Safety notes:

• - Verifies payment receipt before executing work.
• Rejects malformed session IDs and invalid amount values.
• Uses bounded concurrency and body size limits.

Example:

CODEBLOCK7

Additional Tools

• - safe_hire_agents_batch: batch hires with bounded concurrency and failure policy
• INLINECODE38: publish capabilities/policy to registry
• INLINECODE39: validate proof locally and optionally against escrow record
• INLINECODE40: fetch and evaluate target reputation profile
• INLINECODE41: produce JSON and markdown profile artifacts
• INLINECODE42: encrypted memory checkpoint + Merkle anchoring
• INLINECODE43: period metrics and operations summary

One-Click Setup

1. 1. Install and configure env:

CODEBLOCK8

1. 2. Build and start MCP server:

CODEBLOCK9

1. 3. First call from host:

CODEBLOCK10

Security-Focused Examples

Example: Safe hire with deterministic idempotency

CODEBLOCK11

Example: Escalation flow for high-risk tx

CODEBLOCK12

Key TypeScript Skeletons

setup_agentic_wallet

CODEBLOCK13

safe_hire_agent

CODEBLOCK14

safe_execute_tx

CODEBLOCK15

safe_listen_for_hire

CODEBLOCK16

Recommended New Tools (Next Iteration)

• - INLINECODE48

- verify TEE quotes and zkML proofs against approved verifier sets

• - INLINECODE49

- submit challenge evidence for disputed task proofs

• - INLINECODE50

- runtime quotas and payer-level controls

Recommended Config Additions

• - SAFE_ENDPOINT_ALLOWLIST: allowed destination domains for outbound A2A calls
• INLINECODE52: hard cap on inbound job value
• INLINECODE53: terminal dedupe window
• INLINECODE54: require SIWx signature binding for paid task requests
• INLINECODE55: encrypted A2A payload mode

Security Disclosure

• - Required environment variables: ANTHROPIC_API_KEY (LLM), BASE_RPC_URL, and one of Privy (PRIVY_APP_ID + PRIVY_APP_SECRET) or Coinbase CDP (COINBASE_CDP_API_KEY_NAME + COINBASE_CDP_API_KEY_PRIVATE_KEY) for MPC wallet signing. Full list in .env.example and _meta.json.
• DEPLOYER_PRIVATE_KEY: Used once by scripts/deploy-contracts.ts for initial on-chain contract deployment only. Not loaded at MCP runtime. Use a throwaway funded key; discard after deployment.
• HTTP listener: safe_listen_for_hire opens an HTTP server on TASK_SERVER_PORT (default 3402), bound to 127.0.0.1 unless explicitly reconfigured.
• File writes: scripts/deploy-contracts.ts writes deployed contract addresses back to .env. scripts/generate-env.ts creates .env interactively. Neither runs automatically on MCP startup.
• External CLI (forge): Used by scripts/deploy-contracts.ts for one-time Solidity contract compilation and deployment only. Not required or invoked at MCP runtime.
• Test files: tests/stress/ contains literal prompt-injection strings (e.g. Ignore all previous instructions) as adversarial test fixtures that verify the input-gate blocks them. These are not instructions to any agent.

Changelog

• - v0.1.1 (2026-03-05)

- added _meta.json with full required env vars, binaries, runtime behavior, and security disclosure for registry scanners - added clarifying headers to stress test files to prevent false-positive prompt-injection scanner alerts - upgraded x402 to ^1.1.0 (fixes GHSA-3j63-5h8p-gf7c)

• - v0.1.0 (2026-03-05)

- initial public release - strict endpoint DNS/IP validation for outbound task delivery - HMAC-signed inbound task auth with nonce replay lock and SIWx hook - completion-state idempotency protection blocks post-completion duplicates - /.well-known/agent-card.json HTTP endpoint - 128 unit tests, zero TypeScript errors, CI coverage gates enforced

Roadmap

1. 1. Complete x402 v2 alignment

• - SIWx auth binding
• batch payment primitive
• optional sponsored gas support

1. 2. ERC-8004 tiered verification

• - tier metadata (basic, tee_attested, zkml_attested, stake_secured)
• verifier registries and revocation handling

1. 3. Cryptoeconomic reputation hardening

• - Sybil graph scoring
• challenge/slash dispute mechanisms

1. 4. Opaque A2A execution

• - encrypted task/result envelopes
• selective metadata disclosure

1. 5. Production SRE posture

• - adaptive rate limits
• weighted queues
• audit log export and incident hooks