ows

Manage wallet custody and policy-gated signing for automated agents.

3|Updated Apr 15, 2026
One-click install
npx skills add https://github.com/Pieverse-Eng/purrfect-skills --skill ows-pieverse-eng
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: ows
Source: https://github.com/Pieverse-Eng/purrfect-skills/tree/main/ows
Command: npx skills add https://github.com/Pieverse-Eng/purrfect-skills --skill ows-pieverse-eng

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manage local wallet custody and policy-gated signing inside isolated pods to prevent exposure of private keys while enabling automated agent-driven on-chain operations. The Skill centralizes wallet creation, key and policy management, scoped API key issuance, and structured signing so agents can perform transactions without ever handling raw secrets.

Core Features & Use Cases

  • Policy-Gated Signing: Create immutable policies that act as default-deny allowlists; API keys can only sign operations permitted by attached policies.
  • Agent-Mode API Keys: Generate scoped tokens (ows_key_...) for agents so passphrases and mnemonics never leave the vault.
  • Comprehensive Wallet Tools: Create, import, rename, delete wallets; sign messages, EIP-712 typed data, unsigned transactions, and sign-and-broadcast flows across EVM, Solana, Bitcoin and other chains.
  • Integration Patterns: Produce step JSON for downstream skills (purr ows-execute), require explicit user confirmation for writes, and rely on CAIP-2 chain IDs and OWS_PASSPHRASE env usage for secure automation.

Quick Start

Use the ows skill to create a wallet, attach a policy, generate an agent API key, and perform a test signing with OWS_PASSPHRASE set to the generated token.

Frequently Asked Questions about ows

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure automated agent wallet signing without exposing private keys?

Policy-gated wallet signing secures automated agents by issuing scoped API keys that only permit operations defined in an allowlist policy, keeping private keys isolated inside a vault so raw secrets are never exposed during automated on-chain transactions.

How do I set up policy-gated signing for an automated blockchain agent?

Create a local wallet, attach an immutable default-deny policy allowlist, generate a scoped agent-mode API key, and perform a test signing operation using the OWS_PASSPHRASE environment variable to validate the setup.

Can I use local wallet signing for transactions across EVM, Solana, and Bitcoin?

Yes, local wallet signing supports EVM, Solana, Bitcoin, and other chains by requiring CAIP-2 chain identifiers to route transactions, allowing agents to sign messages, EIP-712 typed data, and broadcast flows across multiple networks.

What is an agent-mode API key and how does it differ from using a raw mnemonic?

An agent-mode API key is a scoped token (ows_key_...) that authorizes specific policy-permitted signing operations, differing from a raw mnemonic by ensuring passphrases never leave the vault during automated agent deployments.

Do I need to confirm every transaction when using automated agent wallet signing?

Yes, the policy-gated signing process requires explicit user confirmation for all write operations and utilizes JSON output flags, ensuring automated agents cannot execute unauthorized on-chain writes without human approval.

What are the limitations of using default-deny policy allowlists for wallet signing?

Default-deny policy allowlists restrict agent-mode API keys to only signing operations explicitly defined in the attached policy, meaning any unlisted transaction type or operation will be blocked from execution.