Verified Agent Identity

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:17 AM UTC
• Version: 0.1.1

Overview

This identity skill is coherent and not deceptive, but it needs review because it creates and uses long-lived signing keys that can be stored in plaintext by default.

Review before installing. Use this only if you intend the agent to hold a persistent DID signing key. Set a strong, random BILLIONS_NETWORK_MASTER_KMS_KEY before creating identities, protect $HOME/.openclaw/billions with restrictive permissions, avoid shared or backed-up hosts for this data, and require explicit confirmation before signing challenges or linking identities. Update or pin dependencies before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/shared/storage/keys.js:47

Finding

Private Keys Are Stored in Plaintext by Default Without Enforced Owner-Only Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/verifySignature.js:17

Finding

Verification Challenges Do Not Expire and Remain Reusable After Successful Verification

Content

View full analysis

entry.did === did); if (index >= 0) { // Update existing entry entries[index] = { did, challenge, created_at }; } else { // Add new entry entries.push({ did, challenge, created_at }); } await this.writeFile(entries); } async getChallenge(did) { const entry = await this.find(did); return entry?.challenge; } ``` ```js // Get the stored challenge const challenge = await challengeStorage.getChallenge(args.did); if (!challenge) { console.error(`Error: No challenge found for DID: ${args.did}`); console.error("Generate a challenge first with generateChallenge.js"); process.exit(1); } // Create DID resolver that fetches from remote resolver const resolveDIDDocument = { resolve: async (did) => { const resp = await fetch( `https://resolver.privado.id/1.0/identifiers/${did}`, ); const didResolutionRes = await resp.json(); return didResolutionRes; }, }; // Create JWS packer and unpack token const jws = new JWSPacker(kms, resolveDIDDocument); const basicMessage = await jws.unpack(byteEncoder.encode(args.token)); // Verify the sender if (basicMessage.from !== args.did) { console.error( `Error: Invalid from: expected from ${args.did}, got ${basicMessage.from}`, ); process.exit(1); } // Verify the challenge matches const payload = basicMessage.body; if (payload.message !== challenge) { console.error( `Error: Invalid signature: challenge mismatch ${payload.message} !== ${challenge}`, ); process.exit(1); } outputSuccess("Signature verified successfully"); ``` ### Technical Analysis Challenge record ...[truncated 1766 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/shared/storage/crypto.js:9

Finding

Master Keys Are Derived with a Fast Unsalted Hash

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (35)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

md

| `identities.json`  | Identity metadata                                                                  |
| `defaultDid.json`  | Active DID and associated public key                                               |
| `challenges.json`  | Per-DID challenge history                                                          |
| `credentials.json` | Verifiable credentials                                                             |

There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill is presented as identity verification/linking, but the content reveals it also performs sensitive key management and local persistence of private keys, including possible plaintext storage when no master key is set. This mismatch increases the chance that users or orchestrators invoke it without understanding that it can create, import, store, and use long-lived cryptographic secrets.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

entity description: Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] } } } homepage: https://billions.network/

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

bash

cd scripts && npm inst

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill documents storage of highly sensitive materials including private keys, credentials, identities, and profiles under a predictable local path, and notes that kms.json may be plaintext if no master key is configured. In an agent environment, any skill that can access or influence handling of such files materially increases the risk of credential theft, identity impersonation, and persistence compromise.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

- `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

ws 8.18.0 is present and the cited advisories indicate memory disclosure and memory-exhaustion denial of service in WebSocket handling. In an agent identity/authentication skill, network-facing WebSocket components can be exposed to untrusted peers, making availability and possible data leakage concerns more significant than in an offline utility.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

brace-expansion 2.0.2 has multiple denial-of-service conditions from pathological expansion patterns, and the vulnerable version is present in the lockfile. This is mainly dangerous where attacker-controlled patterns reach the library, but DoS issues are still meaningful for agent services that process external input or tooling requests.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

fast-uri 3.1.0 is present with multiple host confusion and SSRF-related advisories, making it a genuine security issue in software that parses attacker-controlled URLs. This skill’s decentralized identity stack may resolve DIDs, fetch JSON-LD contexts, or contact registries over the network, so URI parsing flaws can materially increase SSRF and trust-boundary bypass risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

ws 7.5.10 is affected by a memory exhaustion denial-of-service issue and is present in the dependency tree. Because identity and proof services may maintain persistent client/server WebSocket connections, an attacker could potentially degrade or crash the service with crafted fragmented traffic.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: underscore==1.13.6 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

underscore 1.13.6 has recursion-based DoS issues in _.flatten and _.isEqual, and the vulnerable version is included. If attacker-controlled nested structures are compared or flattened anywhere in the dependency chain, this can lead to stack exhaustion or heavy resource consumption in a long-running agent service.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

undici 5.29.0 is present with multiple HTTP smuggling, queue poisoning, and injection-related advisories, making it a significant genuine dependency risk. This is especially relevant here because identity workflows often perform outbound HTTP requests to registries, DID documents, or context endpoints, so request handling flaws can enable SSRF-like abuse, desynchronization, or cross-request contamination.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

ws 8.17.1 is present and affected by memory disclosure and memory exhaustion vulnerabilities. In a networked authentication/identity skill, WebSocket flaws can threaten both service availability and confidentiality if exposed components or transitive consumers handle untrusted traffic.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The code stores credentials and identity records in predictable local files such as credentials.json and identities.json. Because this skill handles decentralized identity and authentication proofs, exposing credential contents can enable privacy compromise, replay support, profiling, or facilitate impersonation when combined with stolen key material.

Content

Scanner excerpt · scripts/shared/bootstrap.js (reported line 54)May include surrounding context.

js

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code intentionally falls back to storing privateKeyHex unencrypted on disk when no master key is available. Because this module manages cryptographic identity keys for agents, plaintext-at-rest storage can expose long-lived private keys to any attacker, process, backup system, or user with filesystem access, enabling identity theft, impersonation, and unauthorized signing.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The README instructs users to run npx clawhub@latest install verified-agent-identity, which fetches and executes the latest package version at install time rather than a pinned, reviewed version. This creates a supply-chain risk: if the upstream package or a dependency is compromised, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The human installation instructions also use npx clawhub@latest, again causing remote code execution of whatever package version is current at the time of use. Because this is an identity/key-management skill, compromise at install time could directly expose private keys, credentials, or manipulate trust flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly documents that when BILLIONS_NETWORK_MASTER_KMS_KEY is not set, private keys are stored as raw hex strings on disk. Although encryption is described as optional, this skill manages decentralized identities and signing keys, so plaintext-at-rest storage materially increases the chance of credential theft from local compromise, backups, logs, or misconfigured file permissions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill explicitly describes networked identity operations and access to sensitive local state under $HOME/.openclaw/billions, but it declares no tool scope or permissions boundary. In an agent environment, missing explicit restrictions can allow broader-than-expected execution, network access, and exposure of local identity material during normal invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation guidance is broad enough to match common identity and authentication requests such as signing challenges or linking ownership, which are sensitive actions. In an agentic setting, generic triggers can cause the skill to activate in situations where user intent is ambiguous, leading to unintended signing, identity linking, or disclosure of verification artifacts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example user request 'Link your agent identity to me' is overly generic for a sensitive identity-linking action and the example proceeds directly to execution. This creates a realistic path for social engineering or accidental authorization of ownership-linking operations without validating who requested it, what challenge is being signed, or whether the user intended a trust-binding action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code performs a persistent storage write via didsStorage.save(), which affects user data/state. Although there are comments describing the action for developers, there is no user-facing confirmation, prompt, or visible disclosure in this file before saving the new default identity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The bootstrap code persists sensitive wallet material and identity data to local JSON files via KeysFileStorage and IdentitiesFileStorage without any visible encryption, permission hardening, or user disclosure. In an identity/authentication skill, local file storage of keys and identities materially increases the risk of credential theft, impersonation, and accidental leakage from backups, shared workspaces, or compromised hosts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The code reads BILLIONS_NETWORK_MASTER_KMS_KEY from the environment, which is a credential-sensitive operation. While there are internal comments about validation, there is no user-facing warning, log, prompt, or disclosure in this file indicating that the skill accesses a sensitive secret from the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code persists data by saving a generated challenge under the provided DID, but the file itself only comments on the action for developers and does not provide any user-facing confirmation, warning, or disclosure. Under the code-file criteria, file or data writes should have some visible disclosure unless clearly covered elsewhere, which is not evident in this file.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==13.0.0 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

The lockfile includes uuid 13.0.0, and the cited issue affects v3/v5/v6 when a caller supplies an output buffer with insufficient bounds. In a dependency lockfile this is a real supply-chain risk because vulnerable code is present, though exploitability depends on whether the skill or a dependency actually invokes the affected APIs with attacker-influenced inputs.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==9.0.1 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

uuid 9.0.1 is present and is affected by the same missing buffer bounds check issue for v3/v5/v6 with a provided buf argument. This is a real vulnerable dependency entry, but practical impact remains limited unless the affected API shape is exercised with attacker-controlled parameters.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.