Hackathon
SkillGuard
An approval step between a Solana AI agent and a wallet: the agent declares what it wants to do, policy decides whether a human must look, and the decision is recorded on-chain as a hash.
An AI agent with a wallet needs some authority and not all of it. SkillGuard puts a decision point in between: the agent submits a signed description of what it intends to do, a policy decides whether that can be auto-approved, and anything else lands in a phone app where the wallet’s owner approves or rejects it.
- Shape
- Signed manifest → policy → human inbox → on-chain receipt
- On-chain
- Anchor program on Solana devnet, hashes only
- Approval
- Android app over Mobile Wallet Adapter
- Built in
- Three days, tagged v0.1.0-devnet
- Repository
- VincenzoImp/skillguard
The problem
The tempting design is a firewall that intercepts every signature. The repository contains a feasibility study, written before the code, that argues against building that, and the reason is worth more than the product. A universal interception layer expands the blast radius, cannot guarantee downstream protocol behaviour from a short summary, and cannot stop a user signing a similar transaction somewhere else. Its conclusion is that the honest boundary belongs in the README, because stating it makes the project more credible.
So this is deliberately narrower: it governs the actions that agents route through it, and says so.
What I built
An agent registers a public key and pairs with a wallet by QR, after which the owner signs a challenge. From then on, the agent submits an action manifest – a small typed JSON object – signed with its own key. The signature proves the manifest was not tampered with in transit; it proves nothing about whether the agent is telling the truth, which is precisely why a human stays in the loop.
The policy engine evaluates it against per-agent rules: allowed network, allowed protocols, allowed mints, a spending ceiling, an expiry, and one of three modes. Auto-approval is deliberately almost useless: only a zero-spend, low-risk manifest with no raw transaction attached can pass without a human. Everything else goes to the phone.
The decision then lands on-chain as a receipt containing the manifest’s hash, the policy result’s hash, and the outcome. Nothing else. The contents never leave the off-chain path.
Hard parts
Deciding what the signature is evidence of. An agent signing its own manifest proves integrity, not honesty: the agent could describe a swap and mean something else. That is unfixable at this layer, and the design responds by keeping the human approval step rather than pretending the manifest is authoritative.
Hashes on-chain, decisions off it. The program stores only hashes, and the policy it holds is reduced to a spending ceiling and three hashed allowlists. The chain checks that a connection is live and that the decision code is valid; it does not evaluate policy. That keeps the receipt cheap and private, at the cost of the chain being unable to enforce anything by itself.
Re-scoring what is already pending. Editing a policy or revoking an agent re-evaluates the actions still waiting for approval, so a revocation applies to the queue and not only to what comes next. The boundary is explicit: SkillGuard governs actions routed through it, not every transaction a wallet can sign.