Verified Agent Identity 2

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:34 AM UTC
• Version: 1.0.0

Overview

The skill is identity-focused and mostly coherent, but it handles durable private keys and signed identity-linking actions without enough containment or reviewable implementation.

Review before installing. Only use this skill if you are comfortable creating or importing an agent identity whose private key may be stored unencrypted under `$HOME/.openclaw/billions`, and do not run replacement scripts or dependencies from an unreviewed source. Require explicit confirmation before creating identities, signing challenges, linking a human owner, or sending verification messages.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:166
• Finding: Unencrypted Private-Key Storage in a Predictable Local Directory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 166-176 **Vulnerability Type**: Plaintext storage of cryptographic key material **Risk Level**: High ### Vulnerable Code Snippet ```markdown The directory `$HOME/.openclaw/billions` contains all sensitive identity data: - `kms.json` - **CRITICAL**: Contains unencrypted private keys - `defaultDid.json` - DID identifiers and public keys - `challenges.json` - Authentication challenges history - `credentials.json` - Verifiable credentials - `identities.json` - Identity metadata - `profiles.json` - Profile data ``` ### Technical Analysis The Skill explicitly documents that private keys are stored unencrypted in `$HOME/.openclaw/billions/kms.json`. A private key is the root credential for the associated decentralized identity. Plaintext storage means that confidentiality depends solely on the local filesystem's access controls. Any process, user, malicious dependency, backup service, or compromised agent operating with permission to read the account's home directory could extract the key without defeating encryption. The predictable storage path also makes the credential easy to locate after obtaining local read access. The artifact does not include the implementation that creates this file, so its file permissions and other compensating controls cannot be verified. ### Attack Path 1. An attacker obtains code execution or filesystem read access under the account running the Skill. This could occur through an unrelated local compromise or a malicious package executed in the same account. 2. The attacker reads `$HOME/.openclaw/billions/kms.json`. 3. The attacker extracts the unencrypted private key. 4. The attacker imports the key into compatible identity software. 5. The attacker signs challenges or other supported messages while impersonating the agent's DID. 6. If services trust that DID, the attacker accesses resources or credentials gra ...[truncated 566 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store private keys in an operating-system keychain, hardware-backed keystore, hardware security module, or dedicated secrets manager. 2. If file-based storage is unavoidable, encrypt private keys at rest with a key that is not stored beside the ciphertext. 3. Restrict the identity directory to the owning account and private-key files to owner-only access, such as directory mode `0700` and file mode `0600`. 4. Avoid accepting private keys through command-line arguments because command histories and process listings may expose them. Use protected standard input or a secure secret-provider integration. 5. Prevent keys from entering logs, backups, diagnostic archives, or version control. 6. Define key rotation and revocation procedures and rotate any key suspected of exposure. 7. Add implementation-level tests that reject insecure permissions and verify encryption at rest. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20
• Finding: Unauditable Dependency Installation and Missing Referenced Implementation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20-25 **Vulnerability Type**: Unsafe or unverifiable dependency installation workflow **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ```bash cd scripts && npm install && cd .. # Step 1: Create a new identity (if you don't have one already) node scripts/createNewEthereumIdentity.js # Step 2: Sign the challenge and generate a verification URL in one call node scripts/linkHumanToAgent.js --to <SENDER> --challenge '{"name": <AGENT_NAME>, "description": <SHORT_DESCRIPTION>}' ``` ``` ### Technical Analysis The Skill instructs users to enter a `scripts` directory and run `npm install`. However, the audited artifact contains only `SKILL.md` and `_meta.json`; it does not contain the referenced `scripts` directory, JavaScript source files, `package.json`, or a dependency lockfile. As packaged, the command stops at `cd scripts` and cannot perform the documented operation. More importantly, the security-sensitive implementation and its dependency graph cannot be audited. If users obtain or reconstruct the missing directory from an external source, `npm install` may resolve unpinned or altered packages and may execute package lifecycle scripts with the privileges of the invoking user. No malicious dependency is present in the supplied artifact, and no remote retrieval instruction was identified. The risk arises from directing users toward an installation workflow whose manifest, lockfile, lifecycle behavior, and implementation are absent and therefore unverifiable. ### Attack Path 1. A user attempts to follow the documented setup procedure and discovers that the `scripts` directory is absent. 2. The user obtains a replacement or similarly named implementation from an unreviewed source, or a later package version supplies an unreviewed dependency manifest. 3. The replacement manifest references a compromised, dependency-confused, typosqua ...[truncated 1008 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include every referenced script and the complete npm manifest in the published artifact so the implementation can be reviewed. 2. Commit a lockfile containing integrity metadata and use `npm ci` rather than unconstrained `npm install` for reproducible installation. 3. Pin direct dependencies to reviewed versions and review transitive dependencies for dependency-confusion, typosquatting, and package-takeover risks. 4. Disable lifecycle scripts during installation with `npm ci --ignore-scripts` where they are unnecessary. Explicitly document and audit any lifecycle script that must run. 5. Perform dependency installation in an isolated, least-privileged environment without access to production identity keys. 6. Add automated software-composition analysis, package-integrity verification, and provenance checks to the release process. 7. Ensure the published Skill is self-contained and fails closed rather than directing users to acquire missing security-sensitive code from unspecified sources. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

---
name: verified-agent-identity
description: Billions/Iden3 authentication and identity management tools for agents. Link, proof, sign, and verify.
metadata: { "category": "identity", "clawbot": { "requires": { "bins": ["node", "openclaw"] } }}
homepage: https://billions.network/
---

## When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need sign a challenge.
3. When you need link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

### After installing the plugin run the following commands to create an identity and link it to your human DID:

```bash
cd scripts && npm install && cd

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill instructs the agent to create identities and link them to a human owner, while later disclosing that sensitive material is stored under $HOME/.openclaw/billions and that kms.json contains unencrypted private keys. There is no explicit warning in the setup/use flow to obtain user consent before generating, importing, or persisting this key material, creating a high risk of unauthorized creation of durable credentials and sensitive secret storage.

Credential Access

High

• Category: Privilege Escalation

Content

- `kms.json` - **CRITICAL**: Contains unencrypted private keys
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The example trigger guidance uses broad conversational phrasing like 'Link your agent identity to me' that can cause an agent to initiate identity-linking operations from ordinary chat without a strong confirmation or consent step. In this skill’s context, those operations can create attestations, send signed responses, or establish identity relationships, so over-broad invocation materially increases the chance of unintended sensitive actions.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.md:134