totp

TOTP-based OTP verification for sensitive operations (env vars, gateway restarts, backup deletions, critical config changes). Uses otplib with window:2 (1 minute tolerance).

# TOTP Verification Skill

Secure OTP verification using TOTP (Time-based One-Time Password) for sensitive operations.

## Purpose

Protect access to:
- `.env` variables
- `openclaw.json` configuration
- Gateway restarts
- Backup deletions
- Critical configuration changes
- External API key operations

## Setup

1. **Install dependencies:**
   ```bash
   npm install
   ```

2. **Generate secret and QR:**
   ```bash
   npm run generate
   ```
   Optionally pass service and account name:
   ```bash
   node scripts/generate-secret.js MyService myuser
   ```

3. **Send the QR image** (`qr.png`) to the user, then delete it immediately:
   ```bash
   rm qr.png
   ```

4. **Set TOTP_SECRET in `.env`:**
   ```env
   TOTP_SECRET=YOUR_BASE32_SECRET_HERE
   ```

5. **Configure Google Authenticator/Authy** with the generated secret or QR.

## Usage

When a sensitive operation is requested:

1. **Agent:** "Please provide your OTP"
2. **User:** Provides 6-digit code from authenticator app
3. **Agent:** Runs verification:
   ```bash
   TOTP_SECRET=$TOTP_SECRET node scripts/verify.js 123456
   ```
4. **If valid (exit 0):** Proceed with operation
5. **If invalid (exit 1):** Deny access

## Files

- `scripts/generate-secret.js` - Generate new TOTP secret and QR
- `scripts/verify.js` - Verify OTP tokens (window:2 = 1 minute tolerance)
- `SKILL.md` - This documentation

## Security Notes

- **Window:** 2 (1 minute tolerance) for time drift
- **Algorithm:** SHA1
- **Digits:** 6
- **Period:** 30 seconds
- **Secret:** Base32 encoded, stored in `.env` as `TOTP_SECRET`

## Integration

This skill should be integrated into the agent's decision flow when:
1. User requests `.env` variables
2. User requests `openclaw.json` contents
3. User requests gateway restart
4. User requests backup deletion
5. Any operation marked as "critical"