Disclosure. This walkthrough was written as part of Verdikta's rewarded "Bring a Task, Build a Habit" campaign. Campaign and support details: https://www.verdikta.org/bounties/support
Verdikta is an escrow-and-AI-jury bounty platform on Base: a creator locks ETH, an AI jury grades submissions against a published rubric, and the first passing submission is paid automatically. It ships two agent skills so your own agent can take part:
verdikta-discover — a wallet-free planning skill. It triages a task and, when outside help makes sense, drafts a bounded "work order" (acceptance criteria + rubric). No wallet, no API key, no spending.
verdikta-bounties-onboarding — the operator skill. It sets up a low-balance wallet and signs reviewed transactions (create / submit / finalize).
This is a hands-on log of installing them on a Hermes agent and running a real discovery, including the parts that didn't go smoothly.
Prerequisites
Node.js. I had Node 24.13.0. Worth knowing up front: the official OpenClaw agent (npm i openclaw) refuses to install on anything below Node 24.16.0 — its preinstall check aborts with this OpenClaw release requires Node >=24.16.0. Since the campaign accepts OpenClaw or Hermes, I went with Hermes rather than upgrading a Node that other projects depend on.
A terminal you control. Keep private keys, seed phrases and API keys out of everything — the wallet-free verdikta-discover never needs them.
- Install the Hermes agent I used the hermes-agent npm bridge (it fetches and runs Hermes Agent itself):
npm install hermes-agent
npm rebuild hermes-agent
npx hermes --version
The first hermes call reported Hermes Agent isolated runtime is not ready, which the npm rebuild step above fixes. Version output:
Hermes Agent v0.22.0 (2026.9.24) · stable
Python: 3.14.7 · OpenAI SDK: 2.24.0
- Install the skills from ClawHub The skills are published on ClawHub (the registry the Verdikta README names), by the maintainer @nigelon11:
npx clawhub search verdikta
verdikta-discover @nigelon11
verdikta-bounties-onboarding @nigelon11
npx clawhub install verdikta-discover
npx clawhub install verdikta-bounties-onboarding
Installed verdikta-discover v1.1.0
Installed verdikta-bounties-onboarding v1.7.2
Note the versions: per the onboarding README, the 1.7.x operator skill is designed to pair with verdikta-discover 1.1.0 from the same repository revision — which is exactly what ClawHub installed.
- Install both skills onto the Hermes agent Hermes keeps its own skill registry and security-scans each skill before enabling. The wallet-free verdikta-discover installs cleanly; the verdikta-bounties-onboarding operator skill trips the scanner (it reads env vars, touches files and runs npm installs — all expected for a skill that manages a wallet), so it is installed with the documented --force flag:
hermes skills install verdikta/verdikta-applications/skills/hermes/verdikta-discover
hermes skills install verdikta/verdikta-applications/skills/hermes/verdikta-bounties-onboarding --force
hermes skills list
Installed Skills
Name | Category | Source | Trust | Status
------------------------------+----------+-----------+-----------+--------
verdikta-bounties-onboarding | | skills.sh | community | enabled
verdikta-discover | | skills.sh | community | enabled
2 hub-installed, 0 builtin, 0 local — 2 enabled, 0 disabled
Both skills are now enabled on the agent. A word on --force: Hermes blocked the operator skill with a "46 high-risk patterns" verdict (rules such as node_process_env, path_traversal, unpinned_npm_install). That is the scanner doing its job — a wallet operator necessarily reads secrets and writes files — so review the skill before forcing it. I installed it from the maintainer's own published release knowingly.
- Run a real action: discovery verdikta-discover is a planning skill — its job is to look at a task and, if outside help is warranted, produce a bounded work-order draft (never a wallet action). The skill ships an example task and a self-contained preview script, so I ran discovery on it:
node skills/verdikta-discover/scripts/preview.bundle.mjs skills/verdikta-discover/examples/assessment.json
Real output (trimmed):
{
"schema_version": "1.0.0",
"decision": "PREVIEW",
"quote_status": "DRAFT_NOT_QUOTED",
"template_id": "source-check-v1",
"network": "UNSELECTED",
"reason": "A bounded independent check or parallel research step may be useful.",
"task_summary": "Independently check three technical claims (synthetic example)",
"procurement": { "mode": "OPEN", "targetHunter": null },
"can_commission": false,
"funds_moved": false,
"deliverable": ["result.json", "evidence.md"],
"acceptance_criteria": [
{ "id": "scope_coverage", "label": "Exact scope and coverage", "must": true }
]
}
That's the whole point of the wallet-free skill: it turned a task into a ready-to-commission work order (template source-check-v1, deliverables result.json + evidence.md, acceptance criteria), while explicitly reporting funds_moved: false and can_commission: false. Nothing was signed, spent, or uploaded.
- The wallet step (what the operator skill adds, and how Zealy linking works) I did not run the operator skill's wallet setup here (it needs real ETH and is out of scope for a wallet-free demo), but here is what it does, straight from its README, so an operator can follow it:
In the skill's scripts/, run npm ci --ignore-scripts, then node onboard.js in a human-controlled terminal after owner approval. The wizard handles network selection, encrypted wallet setup, owner funding and API registration. It does not store the wallet password.
Campaign (Zealy) linking. Zealy credits the wallet that funds or submits on Base, and it can only authenticate a browser/WalletConnect wallet — so you link the agent's address once: copy the encrypted keystore (~/.config/verdikta-bounties/verdikta-wallet.json) to the machine with your browser wallet; in MetaMask → Add account → Import account → type "JSON File", choose the keystore and enter its password; then on Zealy, link that imported account and claim the campaign quests. Linking only signs messages, so the agent keeps sending transactions from the same key with no nonce conflict. Keep the balance low, and remove the imported account from the browser afterwards if you prefer.
Smart-account wallets (Coinbase Smart Wallet / ERC-4337) cannot claim on Zealy — the escrow records the smart account and Zealy can't authenticate it — though they can still deliver work.
Friction I hit (honest notes)
OpenClaw needs Node ≥ 24.16.0. On Node 24.13.0 the install aborts in preinstall. Hermes was the smoother path without touching system Node.
The Hermes bridge needed a rebuild. The first hermes call said the isolated runtime wasn't ready; npm rebuild hermes-agent fixed it.
The operator skill needs --force on Hermes. Hermes' security scanner blocks verdikta-bounties-onboarding with a "46 high-risk patterns" verdict (env access, file writes, unpinned npm installs — all expected for a wallet operator). Installing it is a deliberate --force after reviewing the maintainer's release; the wallet-free verdikta-discover installs with no warnings. I ran the live action with verdikta-discover, which is the right skill for a no-spend demo anyway.
Takeaway
For a hunter who just wants to see what Verdikta would scope before spending anything, verdikta-discover on a Hermes (or OpenClaw) agent is a clean, no-risk first step: install from ClawHub, enable on the agent, run discovery, and you get a structured work order with an objectively gradable rubric — no wallet required. The operator skill is the next step when you're ready to actually create or fund a bounty.
Written for Verdikta's rewarded "Bring a Task, Build a Habit" campaign — https://www.verdikta.org/bounties/support
Top comments (0)