A secure multi-factor authentication layer for AI agents to protect sensitive operations using Time-based One-Time Passwords.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install totp
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install totp using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is TOTP Verification?
The TOTP Verification skill provides a robust security layer for AI coding agents, ensuring that sensitive actions require human-in-the-loop authorization. By implementing Time-based One-Time Passwords (TOTP) through the otplib library, this skill allows developers to gate access to critical system components. This implementation of Openclaw Skills ensures that even if an agent is autonomous, high-risk operations like modifying production environment variables or deleting backups are protected by industry-standard multi-factor authentication.
TOTP Verification Use Cases
- Restricting access to sensitive .env file contents and environment variables.
- Protecting openclaw.json configuration files from unauthorized modifications.
- Authorizing critical system actions such as gateway restarts or backup deletions.
- Validating user identity before performing external API key operations.
- Adding a security layer to any operation designated as critical in the agent workflow.
How TOTP Verification Works
- The developer generates a unique Base32 secret and corresponding QR code using the built-in generation script.
- The secret is securely stored in the environment configuration as TOTP_SECRET, while the user adds the account to an authenticator app.
- When a sensitive operation is triggered, the AI agent pauses and requests a 6-digit OTP from the user.
- The agent executes the verification script that compares the user input against the current valid token with a 1-minute drift tolerance.
- If the verification script returns a success code (exit 0), the agent proceeds with the sensitive task; otherwise, access is strictly denied.
TOTP Verification Setup
Install the necessary dependencies to begin using this skill:
npm install
Generate your unique secret and QR code for your authenticator app:
node scripts/generate-secret.js MyService myuser
Store the resulting secret in your .env file:
TOTP_SECRET=YOUR_BASE32_SECRET_HERE
Finally, delete the generated qr.png file immediately after scanning to maintain security.
TOTP Verification Data Schema & Taxonomy
The skill manages security data through environment variables and specific script logic:
| Attribute | Specification |
|---|---|
| TOTP_SECRET | Base32 encoded string stored as a primary environment variable. |
| Algorithm | Standard SHA1 hashing. |
| Digit Count | Standard 6-digit numeric codes. |
| Period | 30-second token rotation period. |
| Window Tolerance | Value of 2, allowing for a 1-minute time drift margin. |
| Files | verify.js and generate-secret.js located in the scripts directory. |
TOTP Verification Advanced Features
- High-security window configuration allowing for slight time synchronization drift across devices.
- Seamless integration with standard authenticator apps like Google Authenticator and Authy.
- Script-based verification that can be easily integrated into custom agent decision flows for Openclaw Skills.
- Automated QR code generation for quick and error-free user onboarding.
- Support for custom service and account labeling to manage multiple secure environments.
SKILL.md
Loading
Related Openclaw Skills
Video Generator (Remotion)
A programmatic video production workflow that uses React and Remotion to create high-quality motion graphics and brand-consistent promotional content.
Hello Agent World
A fundamental greeting skill that allows AI agents to provide personalized, context-aware introductions in the user's native language.
PVPC Spain Electricity Optimizer
A specialized tool for tracking and optimizing Spanish PVPC electricity prices to minimize domestic energy costs.
Workplace Skill
A sophisticated project management framework for orchestrating multi-agent workflows, isolated memory, and seamless context switching across various codebases.
Odds-API.io Sports Betting Integration
A specialized integration for querying real-time sports events and betting odds from Odds-API.io.
TfL Journey Planner & Disruption Checker
An AI-powered journey planner for London that integrates real-time TfL disruption monitoring and intelligent alternative routing.
METADATA
Featured*
