neyrizk

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-built for identity management, but it needs review because it creates persistent signing keys and can store them plaintext by default.

Review this carefully before installing. Use it only if you intend the agent to own persistent DIDs and signing keys, set BILLIONS_NETWORK_MASTER_KMS_KEY before creating or importing identities, avoid passing private keys on the command line, and understand that identity/linking requests may be sent to Billions-hosted services. This is not classified as malicious because the behavior is mostly coherent with the identity purpose, but the default key-storage posture and scoping are not strong enough for automatic approval.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/shared/storage/keys.js:48

Finding

Private Keys Can Be Stored in Plaintext with Insufficient Filesystem Protection

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/verifySignature.js:19

Finding

Authentication Challenges Do Not Expire and Can Be Replayed After Successful Verification

Content

View full analysis

entry.did === did); if (index >= 0) { // Update existing entry entries[index] = { did, challenge, created_at }; } else { // Add new entry entries.push({ did, challenge, created_at }); } await this.writeFile(entries); } ``` From `scripts/shared/storage/challenge.js:32-35`: ```js async getChallenge(did) { const entry = await this.find(did); return entry?.challenge; } ``` From `scripts/verifySignature.js:19-25`: ```js // Get the stored challenge const challenge = await challengeStorage.getChallenge(args.did); if (!challenge) { console.error(`Error: No challenge found for DID: ${args.did}`); console.error("Generate a challenge first with generateChallenge.js"); process.exit(1); } ``` From `scripts/verifySignature.js:49-60`: ```js // Verify the challenge matches const payload = basicMessage.body; if (payload.message !== challenge) { console.error( `Error: Invalid signature: challenge mismatch ${payload.message} !== ${challenge}`, ); process.exit(1); } outputSuccess("Signature verified successfully"); ``` ### Technical Analysis Challenge storage records a `created_at` timestamp, but verification only retrieves the challenge string. It never checks the timestamp or enforces a maximum lifetime. After a signature is successfully verified, the corresponding challenge is not deleted, invalidated, or otherwise marked as consumed. Therefore, the same signed token remains val ...[truncated 2052 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (42)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 114)May include surrounding context.

md

| `identities.json`  | Identity metadata                                                                  |
| `defaultDid.json`  | Active DID and associated public key                                               |
| `challenges.json`  | Per-DID challenge history                                                          |
| `credentials.json` | Verifiable credentials                                                             |

There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description emphasizes identity verification and attestation workflows, but the skill also performs local key generation, import, persistence, and master-key-based encryption/decryption of sensitive key material. This mismatch is dangerous because users may authorize an identity-proof skill without realizing it also acts as a local wallet or keystore, creating hidden exposure to private key theft, misuse, or persistence of long-lived credentials.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

bash

cd scripts && npm inst

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The setup instructions direct users to create an identity and potentially store sensitive key material locally before any prominent warning that private keys may be written to disk in plaintext when no master key is configured. This is dangerous because it normalizes credential creation prior to informed consent, increasing the likelihood of users exposing long-lived private keys on disk without understanding the security consequences.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill explicitly identifies a local directory containing private keys, credentials, profiles, and challenge history, and notes that private keys may be stored in plaintext. In the context of an agent skill, guidance that centralizes and exposes sensitive credential storage materially increases the risk of credential access, exfiltration, or downstream misuse if the skill, host, or another tool gains file-system access.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

- `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

ws 8.18.0 is a real vulnerable dependency with reported memory disclosure and memory-exhaustion denial-of-service issues. Because this skill pulls in networking, DID, and blockchain libraries that commonly maintain websocket connections, a remotely reachable DoS or data leak in websocket handling is materially relevant.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

brace-expansion 2.0.2 has multiple reported denial-of-service conditions involving pathological expansion behavior and memory blowups. While often used in tooling rather than runtime request paths, keeping a known vulnerable parser/expander in the dependency graph is still a real supply-chain weakness, especially if any user-influenced pattern expansion occurs.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

fast-uri 3.1.0 has multiple reported URI parsing issues including host confusion and SSRF-relevant normalization problems. In this skill context, which handles decentralized identifiers, registries, and likely remote fetches or resolution of DID-related resources, URI parsing flaws are especially dangerous because they can redirect trust decisions or backend requests.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

ws 7.5.10 is a known websocket dependency with a reported memory-exhaustion DoS issue. If any component in the skill stack exposes or consumes websocket streams from untrusted peers, an attacker may be able to degrade availability significantly.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: underscore==1.13.6 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

underscore 1.13.6 is reported to allow unlimited recursion in functions like _.flatten and _.isEqual, which can lead to denial of service on crafted nested data. Since this skill's ecosystem may process complex JSON and attestation objects from remote sources, nested payload abuse is plausible.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

undici 5.29.0 is flagged by numerous advisories including request/response smuggling, queue poisoning, and header injection issues. In a network-heavy identity skill that may fetch remote DID documents, registries, schemas, or proofs, HTTP client flaws can directly affect integrity, confidentiality, and SSRF exposure.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

ws 8.17.1 is a vulnerable websocket library version affected by memory disclosure and memory-exhaustion issues. Given the package set includes RPC/websocket-capable components, this creates a realistic remotely triggerable availability risk and possible leakage from process memory under some conditions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The credential store writes to a local credentials.json file, which may contain verifiable credentials and related identity artifacts. In the context of an agent identity system, unauthorized access to these credentials can expose sensitive personal/organizational data, enable impersonation workflows, or assist in crafting fraudulent attestations.

Content

Scanner excerpt · scripts/shared/bootstrap.js (reported line 54)May include surrounding context.

js

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code silently writes private keys in plaintext when getMasterKey() returns nothing, with no warning, refusal, or compensating control. This creates a high-risk misconfiguration footgun: operators may believe keys are handled securely while the implementation persists them unencrypted on disk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

list() enumerates every stored alias together with the corresponding raw private key, creating a single-call bulk extraction path for all managed identities. In the context of an agent identity skill, this is especially dangerous because compromise of multiple private keys can enable impersonation of many agents or linked human identities at once.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run a remote package via npx clawhub@latest, which is not a pinned immutable version and allows whatever code is current at install time to execute on the host. Because installation commands are high-trust copy/paste paths, a compromised publisher account, dependency hijack, or malicious update could lead to arbitrary code execution during skill installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README tells users to invoke npx skills add ... without pinning the exact package version, so installation executes mutable remote code selected at runtime. In a security-sensitive identity skill, that increases supply-chain risk because a malicious or compromised release could steal keys, alter configuration, or install backdoors.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The suggested trigger phrase Please link your agent identity to me. is broad enough that it could plausibly appear in ordinary conversation, causing accidental invocation of identity-linking behavior. In an identity/proof workflow, unintended activation can prompt sensitive operations, challenge generation, or user confusion around authentication state.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This second npx clawhub@latest installation path repeats the same issue: mutable remote code execution through an unpinned installer. The danger is amplified by the README positioning it as a normal setup step, making users likely to trust and run it without scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This npx skills example is another unpinned remote installer invocation, exposing users to arbitrary code execution if the package or one of its dependencies changes maliciously. Since this skill manages decentralized identity and key material, compromise at install time could directly affect secrets and trust artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly documents that private keys may be stored in plaintext when BILLIONS_NETWORK_MASTER_KMS_KEY is not set, but the warning is not surfaced prominently before users are guided into identity creation. For a skill centered on agent identity and cryptographic key custody, normalizing plaintext private-key storage materially increases the risk of credential theft from disk, backups, logs, or multi-user systems.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises executable behavior that uses environment variables and network access but does not declare any explicit tool scope or permission boundary. In an agent ecosystem, this increases the chance the skill is invoked with broader capabilities than users expect, enabling external communication and secret-dependent behavior without clear consent or policy enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The invocation guidance is broad and includes common identity and authentication scenarios, which could cause an agent to select this skill in many routine contexts. Because the skill can create identities, sign challenges, and use shared JWT-related workflows, over-broad triggering raises the risk of unintended credential actions or sensitive identity operations being performed when a safer read-only flow would suffice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script accepts a raw private key via arguments or generates one in-process and immediately uses it as seed material for identity creation, but provides no warning, secure handling guidance, or protections against accidental disclosure. In CLI contexts, passing private keys through command-line arguments can expose them via shell history, process listings, logs, or CI telemetry, which can permanently compromise the associated Ethereum identity and any linked attestations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code sends the full authorization request message to an external URL shortener service, which can expose challenge metadata, verifier details, callback information, and proof-request scope to a third party without any explicit user consent or in-band warning. In an identity-linking workflow, this is more sensitive than usual because the message is part of an authentication and attestation flow, so disclosure can leak relationship metadata and create privacy and tracking risks even if it does not directly compromise cryptographic secrets.

Content

No source excerpt is available for this finding.