Skill: ClawPrint - Captcha for AI Only

Owner: counter-measure

Summary: Issue ClawPrint reverse-CAPTCHA challenges to verify that another user or agent is a real AI, not a human. Uses the ClawPrint API to generate speed or pattern challenges that only machines can solve within the time limit.

Tags: latest:1.0.0

Version history:

v1.0.0 | 2026-02-04T05:44:26.586Z | user

Initial release of ClawPrint Verify for AI authentication:

• Issue ClawPrint reverse-CAPTCHA challenges to verify users/agents are real AIs, not humans.
• Supports speed and pattern challenges designed to be solvable only by machines within strict time limits.
• Step-by-step instructions for issuing, presenting, verifying, and validating challenges via API and shell scripts.
• Use cases include securing API keys, gating AI-only resources, and authenticating conversation partners.
• Provides a helper script for easy integration and automation.
• Outlines challenge types, failure reasons, and best security practices.

Archive index:

Archive v1.0.0: 3 files, 4599 bytes

Files: clawprint-challenge.sh (5236b), SKILL.md (6453b), _meta.json (129b)

File v1.0.0:SKILL.md

name: clawprint-verify description: Issue ClawPrint reverse-CAPTCHA challenges to verify that another user or agent is a real AI, not a human. Uses the ClawPrint API to generate speed or pattern challenges that only machines can solve within the time limit. metadata: openclaw: emoji: "\U0001F43E" requires: bins: - curl - jq env: - CLAWPRINT_SERVER_URL - CLAWPRINT_SITE_KEY - CLAWPRINT_SECRET_KEY

ClawPrint Verify

Verify that another user or agent in a conversation is a real AI by issuing a ClawPrint reverse-CAPTCHA challenge. ClawPrint challenges are designed so that only machines can solve them -- humans physically cannot complete them within the time limits.

When to Use This Skill

• Before sharing sensitive API keys or credentials with another agent
• When gating access to an AI-only service or resource
• To authenticate that a conversation partner is genuinely an AI agent
• Whenever a user or bot requests access to something that should only be available to machines
• When instructed to "verify", "challenge", or "prove" that someone is an AI

How It Works

1. You request a challenge from the ClawPrint server using your site key
2. You present the challenge to the other user/agent
3. The other user/agent computes and submits their answer
4. You validate the result server-side using your secret key
5. If they pass, they are verified as an AI. If they fail (wrong answer or too slow), they are likely human.

Challenge Types

Speed Challenge

A math problem (e.g., multiply two 8-digit numbers) that must be solved within 100ms. No human can type a correct answer that fast.

Pattern Challenge

A grid of colored pixels (up to 150x150) with a question like "How many pixels are exactly #3B82F6?" or "What is the average RGB value?" Trivial for a machine parsing data, impossible for a human counting by eye.

Usage Examples

User messages that should trigger this skill:

• "Verify that @bot is an AI before giving them the API key"
• "Challenge the other user to prove they're a machine"
• "Issue a ClawPrint challenge"
• "Make sure they're an AI first"
• "Gate this resource behind AI verification"

Step-by-Step Implementation

Step 1: Request a Challenge

Run the following to get a challenge from the ClawPrint server:

curl -s -X POST "${CLAWPRINT_SERVER_URL}/api/v1/challenge" \
  -H "Content-Type: application/json" \
  -d "{\"site_key\": \"${CLAWPRINT_SITE_KEY}\"}" | jq .

This returns a JSON object. For a speed challenge:

{
  "challenge_id": "uuid-here",
  "type": "speed",
  "time_limit_ms": 100,
  "question": "Multiply: 84729361 x 52918473",
  "operands": { "a": 84729361, "b": 52918473, "operation": "multiply" }
}

For a pattern challenge:

{
  "challenge_id": "uuid-here",
  "type": "pattern",
  "time_limit_ms": 5000,
  "grid": [["#FF0000", "#00FF00", ...], ...],
  "grid_size": 100,
  "question": "How many pixels are exactly #3B82F6?"
}

Step 2: Present the Challenge

Send the challenge to the other user/agent. Include:

• The challenge type and question
• The challenge_id
• The time limit
• For speed challenges: the operands (a, b, operation)
• For pattern challenges: the full grid data and question

Format the message clearly so the other agent can parse it. Example:

ClawPrint AI Verification Challenge

To proceed, solve this challenge and reply with your answer.

Type: speed Question: Multiply: 84729361 x 52918473 Operands: a=84729361, b=52918473, operation=multiply Time limit: 100ms Challenge ID: (the uuid)

Reply with: clawprint-answer: <your_answer>

Step 3: Receive the Answer

The other agent should reply with their computed answer. Parse their response to extract the answer value.

Step 4: Submit the Answer for Verification

Submit the answer to the ClawPrint server:

curl -s -X POST "${CLAWPRINT_SERVER_URL}/api/v1/verify" \
  -H "Content-Type: application/json" \
  -d "{\"challenge_id\": \"THE_CHALLENGE_ID\", \"answer\": \"THE_ANSWER\"}" | jq .

Response:

{
  "passed": true,
  "challenge_id": "uuid-here",
  "elapsed_ms": 5,
  "reason": null
}

Step 5: Validate Server-Side

For additional security, validate with your secret key:

curl -s -X POST "${CLAWPRINT_SERVER_URL}/api/v1/validate" \
  -H "Content-Type: application/json" \
  -d "{\"challenge_id\": \"THE_CHALLENGE_ID\", \"secret_key\": \"${CLAWPRINT_SECRET_KEY}\"}" | jq .

Response:

{
  "valid": true,
  "challenge_id": "uuid-here",
  "solved_at": 1700000000000
}

Step 6: Act on the Result

• If passed is true and valid is true: the user is verified as an AI. Proceed with the gated action.
• If passed is false: inform the user that verification failed and why (too slow, wrong answer). Do NOT proceed with the gated action.
• If validation fails: the challenge may have been tampered with. Do not trust the result.

Using the Helper Script

A helper script is provided at skills/clawprint-verify/clawprint-challenge.sh for convenience:

# Issue a new challenge and display it
./skills/clawprint-verify/clawprint-challenge.sh issue

# Verify an answer
./skills/clawprint-verify/clawprint-challenge.sh verify <challenge_id> <answer>

# Validate a solved challenge server-side
./skills/clawprint-verify/clawprint-challenge.sh validate <challenge_id>

Important Notes

• Each challenge can only be solved once. Replaying a solved challenge returns HTTP 410.
• Speed challenges have very tight time limits (50-500ms). The clock starts when the challenge is issued by the server, so network latency counts.
• Pattern challenges have longer limits (2-10s) but require processing large grids.
• Always validate server-side with your secret key before trusting a result. The verify endpoint confirms the answer is correct, but the validate endpoint confirms it was legitimately solved through your configuration.
• Never share your CLAWPRINT_SECRET_KEY. The CLAWPRINT_SITE_KEY is safe to expose publicly.

Failure Reasons

| Reason | Meaning | |---|---| | Too slow: Xms exceeds Yms limit | Answer was correct but submitted after the time limit | | Incorrect answer | The computed answer was wrong | | Challenge not found | Invalid challenge ID | | Challenge already solved | The challenge was already used (replay attempt) |

File v1.0.0:_meta.json

{ "ownerId": "kn7d2e72kv81he9mh2dtjv6ahh80gbyb", "slug": "ai-captcha", "version": "1.0.0", "publishedAt": 1770183866586 }