1claw

72 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By cyotee/indexedex (GitHub) · security · 10 stars · scanned at commit 90ff030

HSM-backed secret management for AI agents. Store API keys (including Bankr `bk_` keys), passwords, and credentials in an encrypted vault; retrieve them at runtime via MCP without keeping secrets in chat context. Bankr Dynamic Key Vending issues short-lived scoped `bk_usr_` keys from a partner key (`bk_ptr_`) without manual rotation. Policy-based access control, secret rotation, sharing, EVM transaction intents (sign/simulate/broadcast), multi-chain signing keys, treasury multisig proposals, OI…

Works with any agent that supports SKILL.md skills.

What this skill can do

Sends data to these websites: api.1claw.xyz

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 12 places.

lib/bankr-skills/1claw/SKILL.md, line 106curl -s -X POST https://api.1claw.xyz/v1/agents/enroll \
lib/bankr-skills/1claw/SKILL.md, line 311TOKEN=$(curl -s -X POST https://api.1claw.xyz/v1/auth/agent-token \
lib/bankr-skills/1claw/SKILL.md, line 315curl -s -X PUT "https://api.1claw.xyz/v1/vaults/${VAULT_ID}/secrets/keys/bankr-api-key" \

Show 9 more

lib/bankr-skills/1claw/SKILL.md, line 439curl -s -X POST https://api.1claw.xyz/v1/auth/federated-token \
lib/bankr-skills/1claw/catalog.json, line 10"code": "# Validate API connectivity and credential setup\n./1claw/scripts/validate-setup.sh\n\n# Exchange an ocv_ agent key for a short-lived JWT\nTOKEN=$(curl
lib/bankr-skills/1claw/references/mcp-and-api.md, line 16curl -s -X POST https://api.1claw.xyz/v1/auth/agent-token \
lib/bankr-skills/1claw/references/mcp-and-api.md, line 40curl -s -X POST https://api.1claw.xyz/v1/auth/federated-token \
lib/bankr-skills/1claw/references/mcp-and-api.md, line 57curl -s https://api.1claw.xyz/v1/health # API + DB connectivity
lib/bankr-skills/1claw/references/mcp-and-api.md, line 58curl -s https://api.1claw.xyz/v1/health/hsm # HSM (KMS) availability
lib/bankr-skills/1claw/scripts/validate-setup.sh, line 75health_code=$(curl -s -o "${TMPDIR_VALIDATE}/health.json" -w '%{http_code}' "${BASE_URL}/v1/health" || true)
lib/bankr-skills/1claw/scripts/validate-setup.sh, line 98token_body=$(curl -s -w '\n%{http_code}' -X POST "${BASE_URL}/v1/auth/agent-token" \
lib/bankr-skills/1claw/scripts/validate-setup.sh, line 128list_code=$(curl -s -o "${TMPDIR_VALIDATE}/vaults.json" -w '%{http_code}' \

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 7 places.

lib/bankr-skills/1claw/SKILL.md, line 106curl -s -X POST https://api.1claw.xyz/v1/agents/enroll \
lib/bankr-skills/1claw/SKILL.md, line 169./1claw/scripts/validate-setup.sh
lib/bankr-skills/1claw/SKILL.md, line 179ONECLAW_BASE_URL=https://vault.mycompany.com ./1claw/scripts/validate-setup.sh --allow-custom-base-url

Show 4 more

lib/bankr-skills/1claw/SKILL.md, line 2191claw agent bankr-key lease <agent-id> --ttl 600
lib/bankr-skills/1claw/SKILL.md, line 311TOKEN=$(curl -s -X POST https://api.1claw.xyz/v1/auth/agent-token \
lib/bankr-skills/1claw/SKILL.md, line 439curl -s -X POST https://api.1claw.xyz/v1/auth/federated-token \
lib/bankr-skills/1claw/SKILL.md, line 517npm install -g @1claw/cli@0.32.1

Downloads and installs other software

The author does not mention this.

Found in 6 places.

lib/bankr-skills/1claw/SKILL.md, line 123"command": "npx",
lib/bankr-skills/1claw/SKILL.md, line 133> **Supply-chain safety:** Always pin to a known-good version (e.g. `@1claw/mcp@0.32.2`). Running `npx -y @1claw/mcp` without a version tag risks executing comp
lib/bankr-skills/1claw/SKILL.md, line 156"command": "npx",

Show 3 more

lib/bankr-skills/1claw/SKILL.md, line 517npm install -g @1claw/cli@0.32.1
lib/bankr-skills/1claw/SKILL.md, line 524> **Pin CLI version:** Always install a specific version (`@1claw/cli@0.32.1`). Running `npm install -g @1claw/cli` without a version risks supply-chain attacks
lib/bankr-skills/1claw/catalog.json, line 13"Install: `npx skills add 1claw`",

Can call paid AI services billed to you

This is disclosed by the author in the skill's SKILL.md or README.

Found in 2 places.

lib/bankr-skills/1claw/SKILL.md, line 442-d '{"grant_type":"urn:ietf:params:oauth:grant-type:token-exchange","subject_token_type":"urn:ietf:params:oauth:token-type:jwt","audience":"https://api.anthropi
lib/bankr-skills/1claw/references/mcp-and-api.md, line 46"audience": "https://api.anthropic.com"

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'1claw' ] || [ -L ~/.agents/skills/'1claw' ]; then echo 'A skill folder named 1claw already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/cyotee/indexedex' "$d" && git -C "$d" checkout --quiet '90ff0307a7a8e084aa073e02eff125e9c7973933' -- 'lib/bankr-skills/1claw' && mkdir -p ~/.agents/skills && cp -R "$d"/'lib/bankr-skills/1claw' ~/.agents/skills/'1claw' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'1claw' ~/.claude/skills/'1claw' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for cyotee/indexedex shows the score of its lowest-scoring skill.

SkillTrust badge for cyotee/indexedex

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/cyotee/indexedex.svg)](https://zalavijaysinh.github.io/skilltrust/repos/cyotee/indexedex/)

Score history

Date	Version	Score
2026-11-09	`90ff030`	100

Also found in

Identical copies of this skill exist at:

BankrBot/skills/1claw