Cryptographically verify the identity and integrity of virtual machines running in AMD SEV-SNP confidential computing environments.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install sev-attestation
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install sev-attestation using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is AMD SEV-SNP Remote Attestation?
The sev-attestation skill provides a robust framework for performing AMD SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) remote attestation. It allows developers and security auditors to ensure that a virtual machine is running in a genuine, hardware-isolated environment provided by AMD processors. This is a crucial component within the ecosystem of Openclaw Skills designed for high-assurance confidential computing workflows.
By leveraging this skill, users can establish a root of trust before provisioning sensitive data or secrets to a cloud instance. The tool handles the complexities of interacting with the SEV guest device, fetching AMD certificates, and performing the multi-step cryptographic validation required to prove the Trusted Computing Base (TCB) has not been compromised.
AMD SEV-SNP Remote Attestation Use Cases
- Proving a VM is running in a genuine AMD SEV-SNP confidential computing environment.
- Verifying the integrity of a confidential VM before trusting it with application secrets.
- Auditing hardware-level security configurations for regulatory compliance.
- Debugging attestation failures or certificate chain issues during infrastructure setup.
- Generating cryptographically signed attestation reports for remote third-party verification.
How AMD SEV-SNP Remote Attestation Works
- The skill detects if the host system supports SEV-SNP via the /dev/sev-guest device interface.
- It generates a hardware-backed attestation report that includes a specific nonce for freshness.
- The tool automatically fetches the necessary AMD certificates (ARK, ASK, and VCEK) from the AMD Key Delivery Service (KDS).
- It validates the complete certificate chain (ARK to ASK to VCEK) to ensure authenticity.
- The skill verifies the report signature against the certificate chain using ECDSA P-384.
- A final status of PASSED or FAILED is returned, providing a clear signal for automated security policies.
AMD SEV-SNP Remote Attestation Setup
To use this skill, ensure you have the snpguest Rust CLI, openssl, and curl installed. Root access or membership in the sev group is required to access the hardware device. This setup is compatible with standard Openclaw Skills deployment patterns.
# Install the snpguest prerequisite
cargo install snpguest
# Verify if SEV-SNP is available on the current host
./scripts/detect-sev-snp.sh
# Run the full 6-step attestation workflow
./scripts/full-attestation.sh [output_dir]
AMD SEV-SNP Remote Attestation Data Schema & Taxonomy
The skill organizes its cryptographic artifacts and metadata using a structured file system approach. This allows other Openclaw Skills to easily consume the verification results.
| Artifact | Format | Description |
|---|---|---|
| Attestation Report | Binary | The raw report generated by the AMD hardware. |
| Certificate Chain | PEM/DER | The ARK, ASK, and VCEK certificates required for validation. |
| TCB Metadata | Text/Logs | Details regarding the Trusted Computing Base versioning. |
| Verification Result | CLI Output | The final Boolean status of the attestation process. |
AMD SEV-SNP Remote Attestation Advanced Features
- Modular script architecture allowing developers to run individual steps like certificate fetching or report generation independently.
- Support for OpenSSL-based manual verification, reducing reliance on external binary tools for audits.
- Comprehensive error mapping for troubleshooting complex firmware and KDS connectivity issues.
- Integration ready for multi-agent workflows where attestation is a prerequisite for subsequent secure operations.
SKILL.md
Loading
Related Openclaw Skills
Metaso Search
A high-performance search and RAG skill providing AI agents with real-time web access, content extraction, and intelligent question-answering capabilities.
Fanqie Masterclass: Viral Fiction Writing Agent
A comprehensive AI skill for mastering Fanqie platform algorithms and creating viral short-form fiction through automated workflows.
Exa Search
A specialized search integration that leverages the Exa API to deliver structured, LLM-ready web data directly to your environment.
QFPay Payment Integration (HK)
A comprehensive Openclaw Skills integration for the QFPay API, enabling secure multi-method payments for Hong Kong and overseas merchants.
Feishu Docx PowerWrite
Automatically convert Markdown text into perfectly formatted Feishu or Lark Docx documents.
Self-Improving Agent
A dynamic optimization system that analyzes conversation quality to help AI agents learn from every interaction and improve their performance over time.
Featured*
