Security audit
Security checks for vulnerabilities and agentic risk
This identity skill is purpose-aligned but needs Review because it creates, stores, and uses reusable identity private keys with weak default protection and broad signing/linking guidance.
Install only if you are comfortable with this agent creating and holding a reusable Billions identity key. Configure BILLIONS_NETWORK_MASTER_KMS_KEY before creating or importing any identity, protect $HOME/.openclaw/billions from backups and other local users, avoid passing real private keys on the command line, and require explicit human approval before signing challenges or linking identities.
scripts/shared/storage/keys.js:49Private Keys May Be Stored in Plaintext with Permissive Filesystem Permissions
scripts/shared/storage/crypto.js:25Password-Like Master Keys Use Fast, Unsalted SHA-256 Derivation
scripts/verifySignature.js:17Authentication Challenges Are Not Expired or Consumed After Verification
The skill is presented as an identity/verification utility, but its documented behavior includes local key management and storage of sensitive private key material, with plaintext storage possible when a master key is unset. This mismatch can cause operators or higher-level agents to trust and invoke the skill without realizing it performs secret generation, import, persistence, and retrieval operations.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.
cd scripts && npm inst
The skill explicitly documents storage of highly sensitive identity material, including private keys and credentials, in a predictable local directory, with private keys potentially stored in plaintext if the master key is absent. In an agent environment, any over-broad filesystem access, logging, backup, or secondary skill compromise could expose these credentials and enable account takeover or fraudulent identity assertions.
- `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data
ws 8.18.0 is flagged for memory disclosure and memory exhaustion issues, which are relevant in any component accepting untrusted WebSocket traffic. If this dependency is reachable by the skill or its transitive libraries, an attacker could trigger denial of service or potentially expose process memory.
brace-expansion 2.0.2 has multiple denial-of-service conditions involving pathological expansion inputs that can hang the process or exhaust memory. This becomes dangerous wherever glob-like patterns can be influenced by untrusted data, even indirectly through tooling or parsing libraries.
fast-uri 3.1.0 is flagged for multiple URI parsing and canonicalization flaws including host confusion and SSRF-relevant edge cases. In an identity skill that may fetch schemas, DID documents, or remote registry resources, malformed URL handling can materially increase the risk of server-side request forgery or trust-boundary bypass.
ws 7.5.10 is vulnerable to memory exhaustion through fragmented frames and tiny chunks, which can let a remote peer degrade or crash processes handling WebSocket traffic. Even if only transitive, this is significant if any dependency opens WebSocket connections to untrusted infrastructure.
underscore 1.13.6 is flagged for unlimited recursion in functions like _.flatten and _.isEqual, which can cause denial of service on maliciously deep structures. If libraries in this skill compare or flatten attacker-supplied data such as claims, proofs, or registry responses, the issue can become reachable.
undici 5.29.0 is affected by multiple HTTP parsing and request/response handling flaws, including smuggling, queue poisoning, and CRLF-related issues. Because this skill’s domain involves decentralized identity and likely remote HTTP fetches for registries, schemas, or DID resources, vulnerable HTTP client behavior materially increases exposure to SSRF, response confusion, and trust-boundary attacks.
ws 8.17.1 is affected by memory disclosure and memory exhaustion issues that can be triggered by malicious WebSocket peers. In a network-facing agent ecosystem, such flaws are important because they can allow remote instability or leakage even when introduced transitively.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
function newDataStorage(ethStateStorage) {
return {
credential: new CredentialStorage(
new IdentitiesFileStorage("credentials.json"),
),
identity: new IdentityStorage(
new IdentitiesFileStorage("identities.json"),
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
function newDataStorage(ethStateStorage) {
return {
credential: new CredentialStorage(
new IdentitiesFileStorage("credentials.json"),
),
identity: new IdentityStorage(
new IdentitiesFileStorage("identities.json"),
The README instructs users to execute remote code via npx clawhub@latest, which is not a pinned, immutable version and can change over time. If the package or a dependency is compromised, users may run attacker-controlled installer code directly on their systems or agent environments.
The README tells users to run npx skills add ... without pinning the exact package version for the skills CLI. This creates a supply-chain risk because npx may fetch the current package version at execution time, allowing unexpected or malicious code to run if the upstream package is altered or compromised.
The human installation path again recommends npx clawhub@latest install verified-agent-identity, which executes whatever the latest published installer is at runtime. Repeating this pattern broadens exposure because both agent and human operators are directed to use an unpinned remote installer.
The command npx skills add BillionsNetwork/verified-agent-identity references an npx-fetched CLI without an explicit version pin. This is a supply-chain exposure because installation behavior depends on mutable upstream package state rather than a reviewed, fixed artifact.
The basic usage flow has users create identities and potentially persist private keys before presenting a clear, upfront warning that keys may be stored in plaintext unless BILLIONS_NETWORK_MASTER_KMS_KEY is set. In an identity-management skill, that omission is materially risky because compromise of the host, home directory, backups, or logs could expose signing keys tied to decentralized identities.
The skill declares executable behavior that relies on environment variables and network interaction, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, this increases the chance that the skill is invoked with broader-than-expected capabilities, especially because it handles identity creation, signing, and remote registry interactions.
The invocation guidance uses broad triggers such as linking identity, signing challenges, and shared JWT authentication, but does not impose strong authorization or trust checks on who can request these actions. In practice, an agent following this guidance could be socially engineered into signing attacker-chosen challenges or initiating identity-linking flows for untrusted parties.
The script accepts a private key via args.key and uses it to derive a signer and seed for identity creation, which is a safety-sensitive credential handling operation. While there are code comments, there is no user-facing prompt, warning, or disclosure indicating that a supplied private key will be used for identity creation and associated storage/network operations.
The verification flow instructs the agent to ask and respond using fixed English phrases such as "Please provide your DID to start verification" and "Please sign this challenge," with no indication that the agent may adapt to the user's language. This is a natural-language policy concern because it imposes a specific language without user opt-in.
The lockfile includes uuid 13.0.0, which is flagged for a missing buffer bounds check when the buf parameter is used in v3/v5/v6 UUID generation. This is a real supply-chain risk, though exploitability depends on whether the application or a dependency actually invokes the affected API with attacker-influenced buffer arguments.
uuid 9.0.1 carries the same missing buffer bounds check issue in certain UUID generation modes when buf is supplied. This is a genuine dependency vulnerability, but its practical risk remains limited unless the affected API usage is present and attacker-controlled.
ajv 8.17.1 is reported vulnerable to ReDoS when the $data option is enabled, which can allow attacker-crafted inputs or schemas to consume excessive CPU. This is a real issue, but only materially impacts deployments that enable and expose that feature to untrusted input.
elliptic 6.6.1 is flagged for use of a risky cryptographic implementation, which is meaningful in identity and signature-heavy code because subtle crypto weaknesses can undermine authentication guarantees. While the advisory severity is low, this package should be avoided in security-sensitive stacks when safer maintained primitives exist.