eerc-key-management
Handle private eERC keys with strict security and privacy standards.
Install
mkdir -p .claude/skills/eerc-key-management && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/17000" && unzip -o skill.zip -d .claude/skills/eerc-key-management && rm skill.zipInstalls to .claude/skills/eerc-key-management
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Use when the agent must handle eERC keys safely — the user decryption key (derived from a wallet signature, client-side only) and the privileged auditor key — covering derivation, storage, recovery, and rotation.Key capabilities
- →Derive user decryption keys from wallet signatures
- →Manage user decryption keys client-side only
- →Define secure custody for auditor keys
- →Plan forward-looking rotation for auditor keys
- →Identify threats and mitigations for eERC keys
How it works
The skill outlines the lifecycle and custody rules for user decryption keys (derived client-side from wallet signatures) and privileged auditor keys, emphasizing security best practices.
Inputs & outputs
When to use eerc-key-management
- →Deriving encryption keys
- →Auditor key rotation
- →Key management security
About this skill
eERC — Key Management
Overview
eERC privacy depends on two keys. Mishandling either breaks confidentiality or locks users out. This skill defines their lifecycle and custody rules.
1. User decryption key
- Derived deterministically from a wallet signature during
generateDecryptionKey()([[eerc-sdk-registration]]). The same wallet reproduces the same key on any device — no separate backup needed. - Client-side only. It decrypts the user's balances/metadata locally. The contract never sees it.
- Bound to the wallet address. Switching wallets resets decrypted state to
0n(the SDK enforces this).
Rules
- Never log, transmit, or persist it server-side. Keep in memory or, if cached, in secure client storage.
- To "recover," just re-sign with the wallet — do not build a server-side key vault.
- Treat the wallet's signing key as the root of the user's privacy.
2. Auditor key (privileged)
- The auditor's public key is set on the contract by the owner ([[eerc-auditor-compliance]]); the auditor holds the matching private key and can decrypt all transactions via
auditorDecrypt(). - This is a highly privileged key — compromise reveals every user's amounts (and encrypted metadata).
Rules
- Custody it in a dedicated, access-controlled wallet (ideally hardware/HSM or a controlled signer).
- Document who holds it and the retention policy for decrypted data (compliance/jurisdiction).
- Rotation is forward-looking:
setAuditorPublicKey(newAuditor)makes future operations decryptable by the new auditor; it does not retroactively grant access to history encoded for the old auditor. Plan rotation windows.
Threats & mitigations
| Threat | Mitigation |
|---|---|
| Client-side key theft (XSS, malware) | minimize key lifetime in memory; CSP; hardware wallets |
| Auditor key compromise | HSM/multisig custody; rotate; least privilege |
| Lost user key | re-derive from wallet signature (no vault needed) |
| Lost wallet seed | standard wallet recovery — the root of everything |
Common Pitfalls
- Server-side decryption key storage. Defeats the model — keys are client-side.
- Assuming rotation is retroactive. It isn't.
- Treating the auditor key like any service key. It can decrypt everything.
AI Agent Prompt
"Act as a security engineer. Implement eERC key handling: derive the user decryption key from the wallet signature (client-side only), re-derive on new devices, and define secure custody + forward-looking rotation for the auditor key."
References
See references/README.md (ac-eerc-sdk generateDecryptionKey/isDecryptionKeySet, EncryptedERC AuditorManager).
When not to use it
- →When storing decryption keys server-side
- →When assuming auditor key rotation is retroactive
- →When treating the auditor key like any service key
Limitations
- →User decryption keys are client-side only
- →Auditor key rotation is forward-looking, not retroactive
- →Compromise of the auditor key reveals every user's amounts
How it compares
This skill provides specific, privacy-focused key management rules for eERC, ensuring user keys remain client-side and auditor keys are handled with high privilege, unlike general key management.
Compared to similar skills
eerc-key-management side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| eerc-key-management (this skill) | 0 | 1mo | No flags | Advanced |
| 1password | 27 | 3mo | Review | Intermediate |
| security-compliance | 19 | 8mo | Review | Advanced |
| information-security-manager-iso27001 | 11 | 8mo | Review | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by nickthelegend
View all by nickthelegend →You might also like
1password
openclaw
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
security-compliance
davila7
Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing security operations and incident response, and embedding security throughout the SDLC.
information-security-manager-iso27001
davila7
Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies. Provides ISMS implementation, cybersecurity risk assessment, security controls management, and compliance oversight. Use for ISMS design, security risk assessments, control implementation, and ISO 27001 certification activities.
cursor-sso-integration
jeremylongshore
Configure SSO and enterprise authentication in Cursor. Triggers on "cursor sso", "cursor saml", "cursor oauth", "enterprise cursor auth", "cursor okta". Use when working with cursor sso integration functionality. Trigger with phrases like "cursor sso integration", "cursor integration", "cursor".
springboot-security
affaan-m
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
django-security
affaan-m
Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.