T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:166- Finding
Unencrypted Private-Key Storage in a Predictable Local Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
Verified Agent Identity 2
Security checks for vulnerabilities and agentic risk
Overview
The skill is identity-focused and mostly coherent, but it handles durable private keys and signed identity-linking actions without enough containment or reviewable implementation.
Review before installing. Only use this skill if you are comfortable creating or importing an agent identity whose private key may be stored unencrypted under `$HOME/.openclaw/billions`, and do not run replacement scripts or dependencies from an unreviewed source. Require explicit confirmation before creating identities, signing challenges, linking a human owner, or sending verification messages.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:20- Finding
Unauditable Dependency Installation and Missing Referenced Implementation
- Content
View full analysis
--challenge '{"name": , "description": }' ``` ``` ### Technical Analysis The Skill instructs users to enter a `scripts` directory and run `npm install`. However, the audited artifact contains only `SKILL.md` and `_meta.json`; it does not contain the referenced `scripts` directory, JavaScript source files, `package.json`, or a dependency lockfile. As packaged, the command stops at `cd scripts` and cannot perform the documented operation. More importantly, the security-sensitive implementation and its dependency graph cannot be audited. If users obtain or reconstruct the missing directory from an external source, `npm install` may resolve unpinned or altered packages and may execute package lifecycle scripts with the privileges of the invoking user. No malicious dependency is present in the supplied artifact, and no remote retrieval instruction was identified. The risk arises from directing users toward an installation workflow whose manifest, lockfile, lifecycle behavior, and implementation are absent and therefore unverifiable. ### Attack Path 1. A user attempts to follow the documented setup procedure and discovers that the `scripts` directory is absent. 2. The user obtains a replacement or similarly named implementation from an unreviewed source, or a later package version supplies an unreviewed dependency manifest. 3. The replacement manifest references a compromised, dependency-confused, typosqua ...[truncated 1008 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
name: verified-agent-identity description: Billions/Iden3 authentication and identity management tools for agents. Link, proof, sign, and verify. metadata: { "category": "identity", "clawbot": { "requires": { "bins": ["node", "openclaw"] } }} homepage: https://billions.network/
When to use this Skill
Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.
- When you need to link your agent identity to an owner.
- When you need sign a challenge.
- When you need link a human to the agent's DID.
- When you need to verify a signature to confirm identity ownership.
- When use shared JWT tokens for authentication.
- When you need to create and manage decentralized identities.
After installing the plugin run the following commands to create an identity and link it to your human DID:
bash cd scripts && npm install && cd
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to create identities and link them to a human owner, while later disclosing that sensitive material is stored under $HOME/.openclaw/billions and that kms.json contains unencrypted private keys. There is no explicit warning in the setup/use flow to obtain user consent before generating, importing, or persisting this key material, creating a high risk of unauthorized creation of durable credentials and sensitive secret storage.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - `kms.json` - **CRITICAL**: Contains unencrypted private keys - `defaultDid.json` - DID identifiers and public keys - `challenges.json` - Authentication challenges history - `credentials.json` - Verifiable credentials - `identities.json` - Identity metadata - `profiles.json` - Profile data
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example trigger guidance uses broad conversational phrasing like 'Link your agent identity to me' that can cause an agent to initiate identity-linking operations from ordinary chat without a strong confirmation or consent step. In this skill’s context, those operations can create attestations, send signed responses, or establish identity relationships, so over-broad invocation materially increases the chance of unintended sensitive actions.
- Content