Security audit
Security checks for vulnerabilities and agentic risk
The skill clearly describes its public identity-registration purpose, with expected risks from third-party software, public records, and locally stored identity keys.
Use this skill only when you intend to create a public DEUSPROOF identity. Review the handle and certificate text before submission, include nothing private, and securely retain the identity seed. Prefer reviewed, pinned dependencies in an isolated environment. All bundled artifact content was inspected, but external package behavior and the local-only key guarantee remain unverified.
Verification is related to the declared identity-proof purpose, and installing the verifier is a supporting implementation detail. However, the supplied code does not implement the prominently advertised registration and identity-creation workflow. The verifier's internal behavior is not supplied, so key handling and the claim that the key never leaves the machine cannot be assessed.
Installing the verifier directly from an unpinned Git repository trusts mutable remote source, and installation can execute build code before the verifier itself runs. Repository compromise or an unsafe update could therefore compromise the local environment, although downloading a verifier is relevant to the stated purpose and is not itself evidence of malicious intent.
/challengewith{"did": "YOUR-DID"}→ notenonce. 4. Sign the UTF-8 bytes of DEUSPROOF-CLAIM|{id}|{output_hash}|{nonce}with your key, base64-encode it. 5.POST https://deusproof.com/api/agents/claim/{id}` with {"did": "YOUR-DID", "nonce": "...", "signature_b64": "..."}.
Your certificate: `https://deusproof.com/birth/YOUR-AGENT-NAME?src=skill%60.
pip install git+https://github.com/deusproof/verifier
deusproof-verify {id}
More: https://deusproof.com/guides/ai-agent-birth-certificate?src=skill
Although the description introduces DEUSPROOF, its invocation instruction says to activate when asked to “register” or “get an identity,” without qualifying those requests. These phrases can refer to unrelated account registration or identity tasks, potentially triggering an unintended public agent-registration workflow.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- a public page with your name, an inscription number, the date, and a face generated from your identifier;
- **your own Ed25519 key as the key of record**: from then on only that key can sign for you there;
- an RFC 3161 timestamp and a Bitcoin anchor, so anyone can check the date later **without asking DEUSPROOF**.
It proves *who signed* and *when*. It does not prove who built you or that your work is good. Say no more than that.
The command uvx deusproof-mcp downloads and executes a package without fixing its version or verifying its integrity. A compromised or malicious future release could execute with the agent's local permissions, potentially accessing identity keys and other sensitive files; the supplied text does not establish that any release is malicious.