Is erc-8004 safe to install?

SaferSkills independently audited erc-8004 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

erc-8004/SKILL.md · 1 file

erc-8004/SKILL.md4.7 KB · Markdown

name: erc-8004

description: Register AI agents on Ethereum mainnet using ERC-8004 (Trustless Agents). Use when the user wants to register their agent identity on-chain, create an agent profile, claim an agent NFT, set up agent reputation, or make their agent discoverable. Handles bridging ETH to mainnet, IPFS upload, and on-chain registration.

ERC-8004: Trustless Agents

Register your AI agent on Ethereum mainnet with a verifiable on-chain identity, making it discoverable and enabling trust signals.

What is ERC-8004?

ERC-8004 is an Ethereum standard for trustless agent identity and reputation:

Identity Registry - ERC-721 based agent IDs (your agent gets an NFT!)
Reputation Registry - Feedback and trust signals from other agents/users
Validation Registry - Third-party verification of agent work

Website: https://www.8004.org Spec: https://eips.ethereum.org/EIPS/eip-8004

Contract Addresses

Chain	Identity Registry	Reputation Registry
Ethereum Mainnet	`0x8004A169FB4a3325136EB29fA0ceB6D2e539a432`	`0x8004BAa17C55a88189AE136b182e5fdA19dE9b63`
Sepolia Testnet	`0x8004A818BFB912233c491871b3d84c89A494BD9e`	`0x8004B663056A597Dffe9eCcC1965A193B7388713`

Quick Start

1. Register Your Agent

# Full registration (creates profile, uploads to IPFS, registers on-chain)
./scripts/register.sh

# Or with custom values
NAME="My Agent" \
DESCRIPTION="An AI agent that does cool stuff" \
IMAGE="https://example.com/avatar.png" \
./scripts/register.sh

2. Bridge ETH to Mainnet (if needed)

# Bridge ETH from Base to Ethereum mainnet
./scripts/bridge-to-mainnet.sh 0.01

3. Update Agent Profile

# Update your agent's registration file
./scripts/update-profile.sh <agent-id> <new-ipfs-uri>

Environment Variables

Variable	Description	Required
`PINATA_JWT`	Pinata API JWT for IPFS uploads	No (only for IPFS)
`AGENT_NAME`	Agent display name	No (defaults to wallet ENS or address)
`AGENT_DESCRIPTION`	Agent description	No
`AGENT_IMAGE`	Avatar URL	No

Registration Options

Option 1: Use 8004.org frontend (easiest) Visit https://www.8004.org and register through the UI — handles IPFS automatically.

Option 2: HTTP URL (no IPFS needed) Host your registration JSON at any URL:

REGISTRATION_URL="https://myagent.xyz/agent.json" ./scripts/register-http.sh

Option 3: IPFS via Pinata

PINATA_JWT="your-jwt" ./scripts/register.sh

Option 4: Data URI (fully on-chain) Encode your registration as base64 — no external hosting needed:

./scripts/register-onchain.sh

Registration File Format

Your agent's registration file (stored on IPFS) follows this structure:

{
  "type": "https://eips.ethereum.org/EIPS/eip-8004#registration-v1",
  "name": "My Agent",
  "description": "An AI assistant for various tasks",
  "image": "https://example.com/avatar.png",
  "services": [
    {
      "name": "web",
      "endpoint": "https://myagent.xyz/"
    },
    {
      "name": "A2A",
      "endpoint": "https://myagent.xyz/.well-known/agent-card.json",
      "version": "0.3.0"
    }
  ],
  "x402Support": false,
  "active": true,
  "registrations": [
    {
      "agentId": 123,
      "agentRegistry": "eip155:1:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432"
    }
  ],
  "supportedTrust": ["reputation"]
}

Workflow

Bridge ETH (if needed) - Use Bankr to bridge ETH from Base/L2 to mainnet
Create Profile - Generate a registration JSON file with agent info
Upload to IPFS - Pin the file via Pinata (or other provider)
Register On-Chain - Call register(agentURI) on the Identity Registry
Update Profile - Set metadata, wallet, or update URI as needed

Costs

Gas: ~100-200k gas for registration (~$5-20 depending on gas prices)
IPFS: Free tier available on Pinata (1GB)

Using the SDK

For more advanced usage, install the Agent0 SDK:

npm install agent0-sdk

import { SDK } from 'agent0-sdk';

const sdk = new SDK({
  chainId: 1, // Ethereum Mainnet
  rpcUrl: process.env.ETH_RPC_URL,
  privateKey: process.env.PRIVATE_KEY,
  ipfs: 'pinata',
  pinataJwt: process.env.PINATA_JWT
});

const agent = sdk.createAgent('My Agent', 'Description', 'https://image.url');
const result = await agent.registerIPFS();
console.log(`Registered: Agent ID ${result.agentId}`);

erc-8004— agent skill

Is erc-8004 safe to install?

ERC-8004: Trustless Agents

What is ERC-8004?

Contract Addresses

Quick Start

1. Register Your Agent

2. Bridge ETH to Mainnet (if needed)

3. Update Agent Profile

Environment Variables

Registration Options

Registration File Format

Workflow

Costs

Using the SDK

Links

Audit the pieces. Scan the whole. Decide.