Agent Desapetc 999

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:31 AM UTC
• Version: 1.0.0

Overview

The skill does identity work as advertised, but it creates long-lived signing keys that are stored in plaintext by default and uses weak, reusable authentication challenges.

Install only if you are comfortable with this skill creating and storing agent identity keys on this machine. Set BILLIONS_NETWORK_MASTER_KMS_KEY before creating any identity, restrict access to $HOME/.openclaw/billions, avoid passing wallet private keys on the command line, and treat generated signed tokens as reusable secrets until the challenge handling is fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/shared/storage/keys.js:50

Finding

Private Keys Are Stored in Plaintext by Default Without Enforced Owner-Only Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generateChallenge.js:17

Finding

Authentication Challenges Do Not Expire or Become Invalid After Successful Verification

Content

View full analysis

entry.did === did); if (index >= 0) { // Update existing entry entries[index] = { did, challenge, created_at }; } else { // Add new entry entries.push({ did, challenge, created_at }); } await this.writeFile(entries); } ``` `scripts/verifySignature.js:19-22`: ```js // Get the stored challenge const challenge = await challengeStorage.getChallenge(args.did); if (!challenge) { console.error(`Error: No challenge found for DID: ${args.did}`); console.error("Generate a challenge first with generateChallenge.js"); process.exit(1); } ``` `scripts/verifySignature.js:47-54`: ```js // Verify the challenge matches const payload = basicMessage.body; if (payload.message !== challenge) { console.error( `Error: Invalid signature: challenge mismatch ${payload.message} !== ${challenge}`, ); process.exit(1); } ``` ### Technical Analysis Challenge generation selects a decimal value between zero and 9,999,999,999. This provides approximately 33 bits of entropy, substantially below the conventional minimum of 128 random bits for security-sensitive nonces. The storage layer records `created_at`, but verification does not retrieve or inspect that timestamp. As a result, challenges have no enforced lifetime. More importantly, ...[truncated 2220 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as an identity-verification utility, but it also manages and persists private key material locally, including storing keys in plaintext when BILLIONS_NETWORK_MASTER_KMS_KEY is not set. That hidden operational behavior materially changes the trust model: using the skill can create long-lived credential assets on disk that may later be stolen or misused.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

bash

cd scripts && npm inst

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill explicitly documents storage of sensitive identity artifacts, including private keys in kms.json and credentials in credentials.json, under a predictable location in the user's home directory. In an agent ecosystem, discoverable local credential stores are high-value targets for exfiltration, and the risk is amplified because the private keys may be plaintext if no master key is configured.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

- `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

ws 8.18.0 is flagged for memory disclosure and memory-exhaustion denial of service issues, both of which are meaningful in software that may maintain WebSocket connections to wallets, RPC endpoints, relays, or browsers. In an agent identity skill that may communicate with external services, a vulnerable WebSocket stack increases exposure to remote crashes or information leakage.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

brace-expansion 2.0.2 has multiple algorithmic complexity and expansion-related DoS advisories, making it a legitimate vulnerable dependency instance. Even as a transitive package, it can be dangerous if any path allows attacker-controlled glob or pattern expansion, potentially causing hangs or memory exhaustion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

fast-uri 3.1.0 is flagged for multiple URI parsing/canonicalization issues including SSRF and host confusion classes, which are highly relevant in software that may fetch schemas, DID documents, JSON-LD contexts, or remote attestations. In a decentralized identity skill, malformed URL handling can directly affect trust decisions or outbound network access.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

ws 7.5.10 is affected by a memory exhaustion DoS issue and is an older major line than the other ws instances, making it a real and relevant weakness. If reachable through JSON-RPC/WebSocket functionality, a remote peer could trigger excessive resource consumption and disrupt agent operations.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: underscore==1.13.6 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

underscore 1.13.6 is flagged for unlimited recursion in functions like _.flatten and _.isEqual, creating a denial-of-service risk on crafted nested input. Since this arrives through tooling-style dependencies, exploitability may be indirect, but if exposed in request processing it can crash or stall the process.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

undici 5.29.0 has numerous reported HTTP parsing and request-handling issues, including smuggling, queue poisoning, and injection classes, making this a significant network-facing dependency risk. This is particularly concerning in an identity skill that may retrieve remote DID documents, schemas, attestations, or registry data over HTTP.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

ws 8.17.1 is a real vulnerable WebSocket dependency affected by memory disclosure and memory exhaustion issues. Because agent and blockchain ecosystems commonly use persistent socket-based RPC or event streams, this can become remotely reachable and materially affect confidentiality and availability.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

md

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/shared/bootstrap.js (reported line 54)May include surrounding context.

js

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

When no master key is available, _encodeEntry falls back to provider "plain" and writes privateKeyHex directly to kms.json. Storing agent private keys unencrypted on disk creates immediate compromise risk from local file disclosure, backups, logs, container escapes, or accidental source/control artifact inclusion; in an identity/authentication skill, stolen keys can let an attacker impersonate an agent or generate fraudulent proofs.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The list() method returns raw private key material for every stored entry rather than just metadata such as aliases. Any caller with access to this API can bulk-exfiltrate all keys in one operation, greatly increasing blast radius and making accidental disclosure through debugging, logging, or downstream serialization much more likely; in this identity-focused skill, that enables agent impersonation and unauthorized proof generation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to execute npx clawhub@latest install ..., which pulls and runs the latest package version at install time. Using a floating installer version weakens supply-chain integrity because a compromised or malicious future release could be executed automatically by users or agents following the documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This installation command again relies on npx clawhub@latest, causing execution of whatever package version is current at the time the command is run. In an agent-installation context this is especially risky because users may copy-paste the command without independently validating the package version or contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation tells users to pass an Ethereum private key directly on the command line via --key <your-ethereum-private-key>. Command-line secrets are commonly exposed through shell history, process listings, terminal logs, and agent telemetry, which can lead to irreversible compromise of the wallet and any identity derived from it.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes Node scripts that use environment configuration and external network interactions, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent setting, missing capability declarations weakens least-privilege enforcement and can allow the skill to be triggered with broader execution authority than users or orchestrators expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The activation guidance is broad and maps to very common identity-related requests, which increases the chance that an agent auto-invokes the skill in situations where the user did not intend key creation, signing, or identity linking. Because the skill performs sensitive authentication operations, over-broad trigger conditions raise the risk of accidental credential use and privacy-impacting actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The KMS is backed by KeysFileStorage("kms.json"), which persists private key material to a local file. For an agent identity/authentication skill, local plaintext or weakly protected key storage materially increases the risk of key theft, agent impersonation, and unauthorized signing if the host filesystem is exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Credential and identity records are written to local files (credentials.json, identities.json, profiles.json) without any visible protection or disclosure in this file. In an identity wallet context, these files may contain sensitive attestations, identifiers, and profile metadata that could be harvested for privacy loss, correlation, or follow-on attacks if the system is compromised.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The example phrase 'Link your agent identity to me' is generic enough to cause opportunistic activation from ordinary conversation. In this context, that can push an agent toward executing a sensitive identity-linking workflow without sufficient validation of the requester, purpose, or consent.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==13.0.0 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The lockfile pins uuid 13.0.0 in a transitive dependency, and the cited advisory affects v3/v5/v6 when a caller supplies an output buffer that is too small. This is a real supply-chain risk, though typically low impact because exploitation depends on specific application usage patterns rather than mere installation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==9.0.1 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

uuid 9.0.1 is also affected by the same missing bounds check issue, making this a duplicate but still real vulnerable package instance. The practical risk remains low unless code paths use name-based UUID generation with attacker-controlled buffer handling.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ajv==8.17.1 — 1 advisory(ies): CVE-2025-69873 (ajv has ReDoS when using `$data` option)

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

ajv 8.17.1 is reported vulnerable to ReDoS when the $data option is enabled, so this is a real issue only if schemas are evaluated in that mode with attacker-controlled inputs. Given this skill processes identity- and proof-related structured data, schema validation may be reachable, but the exploitability depends on runtime configuration not visible in the lockfile alone.

Content

No source excerpt is available for this finding.