T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:145- Finding
Private Identity Keys Stored in Plaintext by Default
- Content
View full analysis
- Remediation
View remediation
Security audit
Verified Agent Identity
Security checks for vulnerabilities and agentic risk
Overview
This identity skill is mostly purpose-aligned, but it handles cryptographic identity keys in ways that could expose them and links identities with weak confirmation guidance.
Review this skill carefully before installing. Use it only if you are comfortable with local DID private keys being created and stored, set BILLIONS_NETWORK_MASTER_KMS_KEY before creating identities, avoid importing private keys through command-line arguments, and require explicit confirmation before signing challenges or linking an agent identity to a person.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:33- Finding
Private Keys Accepted Through Observable Command-Line Arguments
- Content
View full analysis
]` **Description**: Creates a new identity on the Billions Network. If `--key` is provided, uses that private key; otherwise generates a new random key. The created identity is automatically set as default. **Usage Examples**: ```bash # Generate a new random identity node scripts/createNewEthereumIdentity.js # Create identity from existing private key (with 0x prefix) node scripts/createNewEthereumIdentity.js --key 0x1234567890abcdef... # Create identity from existing private key (without 0x prefix) node scripts/createNewEthereumIdentity.js --key 1234567890abcdef... ``` ``` ### Technical Analysis The documented interface passes an existing private key through the `--key` command-line argument. Command-line arguments are not an appropriate secret-input channel because they may be retained or exposed through: - Shell history files. - Process inspection utilities and `/proc` interfaces. - Audit and endpoint-monitoring systems. - CI/CD logs and orchestration metadata. - Terminal recording, support bundles, or copied command transcripts. Quoting the key would not correct the issue because the resulting process argument would still contain the secret. The referenced implementation is absent from the supplied artifact, so any masking or additional runtime protection cannot be verified; however, the documented invocation itself creates the exposure. ### Attack Path 1. A user imports an existing identity using the documented `--key` option. 2. The shell records the full command in history, or process/audit tooling captures the command-line arguments. 3. An unauthorized local user, compromised process, administrator, monitoring operator, o ...[truncated 828 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
entity description: Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] } } } homepage: https://billions.network/
When to use this Skill
Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.
- When you need to link your agent identity to an owner.
- When you need to sign a challenge.
- When you need to link a human to the agent's DID.
- When you need to verify a signature to confirm identity ownership.
- When you use shared JWT tokens for authentication.
- When you need to create and manage decentralized identities.
After installing the plugin run the following commands to create an identity and link it to your human DID:
bash cd scripts && npm inst
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The skill explicitly documents storage of highly sensitive identity artifacts, including private keys in
kms.jsonthat may be plaintext ifBILLIONS_NETWORK_MASTER_KMS_KEYis unset, along with credentials and authentication history under a predictable path. In combination with the skill's signing and linking workflows, this creates meaningful credential-access risk if another tool, skill, or prompt-induced action reads from that directory or if the host is compromised.- Content
md - `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext) - `defaultDid.json` - DID identifiers and public keys - `challenges.json` - Authentication challenges history - `credentials.json` - Verifiable credentials - `identities.json` - Identity metadata - `profiles.json` - Profile data
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill declares broad, common-language usage triggers such as linking identity, signing challenges, verifying signatures, and using shared JWT tokens. In an agentic environment, these generic phrases can cause the skill to activate in situations where the user did not intend decentralized identity operations, leading to unnecessary handling of sensitive identity material or authentication actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example conversation uses ambiguous phrasing like 'Link your agent identity to me,' which could be interpreted as sufficient authorization to initiate a sensitive identity-linking workflow. Because the documented flow may auto-generate a challenge when one is not supplied, this lowers the bar for triggering a high-trust action and increases the risk of unintended or socially engineered identity association.
- Content