
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
skill-wallet
Advanced tools
The SkillWallet is a permissionless, open-source protocol for the creation of universal, self-sovereign Identities - based on Skills instead of personal data. It comes as an upgradable, Non-Transferable, Non-Fungible-Token (U-NT-NFT) - and it entile
The SkillWallet is a permissionless, open-source protocol for the creation of universal, self-sovereign Identities - based on Skills instead of personal data.
It comes as an upgradable, Non-Transferable, Non-Fungible-Token (U-NT-NFT) - and it entiles native sybil-resistant properties.
Moreover, in order to receive their NT-NFT, individual users need to join a Community/Protocol/Platform. By being part of a Community, they can participate in Gigs/Tasks/Projects, that in return provide them Credits (DITO) - in the form of ERC777 - that they can spend across the whole network, including the Partners that integrate the SkillWallet package in their existing Contract.
Once an individual member's skills are validated (simply by contributing to Gigs), they will be able to spend their Credits, create new tasks/projects, and move to a different Community seamlessly, without losing the Credits & the reputation earned.
The sybyl-resistance features, together with the portability of the Skills & Benefits acquired, makes the SkillWallet the complementary missing piece in the Multiverse, and the NFT space at large.
Behind the hoods, the protocol follows these steps:
When you sign the Partners Agreement from https://playground.skillwallet.id there are two contracts deployed under the hood - PartnersAgreement.sol and Community.sol The Community.sol is managing the membership in the community. PartnersAgreement.sol is managing activities - tasks, polls, and community calls.
In order to use them within your contract after you sign the Partners Agreement, you can use partnersAgreementAddress, that you get after deploying it.
From Partners Agreement, you can use communityAddress() to fetch the community address.
In order to fetch SkillWallet data - such as whether is activated or not, roles, community history - you can use the ISkillWallet interface.
Deployed on Mumbai 0xfb19708dEc0c84b739F98D9AAAE719D236Af3B32!
Tasks and Events are represented by Activities.sol, that is deployed when creating the first one. You can fetch the address of the Activities, by calling getActivitiesAddress().
After finalizing a task/event, the SkillWallet holder's interaction index is increased. In order to access Interactions contract - call getInteractionsAddr() from Activities contract.
SkillWallet
import "skill-wallet/contracts/main/ISkillWallet.sol";
import "skill-wallet/contracts/main/utils/RoleUtils.sol";
Community
import "skill-wallet/contracts/main/community/ICommunity.sol;"
PartnersAgreement
import "skill-wallet/contracts/main/partnersAgreement/interfaces/IPartnersAgreement.sol;"
Activities & Interactions
import "skill-wallet/contracts/main/partnersAgreement/interfaces/IActivities.sol";
import "skill-wallet/contracts/main/partnersAgreement/contracts/Interaction.sol";
FAQs
The SkillWallet is a permissionless, open-source protocol for the creation of universal, self-sovereign Identities - based on Skills instead of personal data. It comes as an upgradable, Non-Transferable, Non-Fungible-Token (U-NT-NFT) - and it entile
We found that skill-wallet demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.