Project Desapetc

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:36 AM UTC
• Version: 1.0.0

Overview

This identity skill appears purpose-aligned, but it needs review because it creates durable identity secrets and can store private keys in plaintext unless encryption is configured.

Review before installing. Use only on a trusted host, set BILLIONS_NETWORK_MASTER_KMS_KEY before creating or importing any identity, avoid passing real private keys with --key, and update vulnerable dependencies before relying on the skill for authentication-sensitive workflows. If it was already run without KMS encryption, treat stored keys as potentially exposed depending on host permissions and backups.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/shared/storage/keys.js:47

Finding

Private keys are stored in plaintext by default without enforced file permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/verifySignature.js:48

Finding

Authentication challenges remain reusable after successful verification

Content

View full analysis

entry.did === did); if (index >= 0) { // Update existing entry entries[index] = { did, challenge, created_at }; } else { // Add new entry entries.push({ did, challenge, created_at }); } await this.writeFile(entries); } async getChallenge(did) { const entry = await this.find(did); return entry?.challenge; } ``` Verification checks equality but does not delete or otherwise consume the challenge: ```js // Verify the challenge matches const payload = basicMessage.body; if (payload.message !== challenge) { console.error( `Error: Invalid signature: challenge mismatch ${payload.message} !== ${challenge}`, ); process.exit(1); } outputSuccess("Signature verified successfully"); ``` ### Technical Analysis A secure challenge-response flow requires the challenge to be unpredictable, short-lived, context-bound, and single-use. This implementation stores one challenge per DID and accepts a signed token whenever its payload matches the currently stored value. Although a `created_at` value is written, `verifySignature.js` retrieves only the challeng ...[truncated 1779 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/createNewEthereumIdentity.js:23

Finding

Existing private keys are accepted through command-line arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (61)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This is a substantively similar issue: the documented purpose understates that the skill persists sensitive key material to the filesystem and may store it unencrypted unless a master key is configured. In an agent ecosystem, that behavioral gap can lead operators to authorize the skill without understanding that it creates credential-storage risk on the host.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This is a substantively similar issue: the documented purpose understates that the skill persists sensitive key material to the filesystem and may store it unencrypted unless a master key is configured. In an agent ecosystem, that behavioral gap can lead operators to authorize the skill without understanding that it creates credential-storage risk on the host.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

ws 8.18.0 is reported with memory disclosure and memory-exhaustion DoS advisories, both of which are serious in software that accepts WebSocket traffic from untrusted peers. In an agent identity skill that may communicate over networked protocols and process external data, retaining a vulnerable WebSocket stack increases exposure if any reachable component uses this package.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

brace-expansion 2.0.2 has multiple DoS-class issues involving pathological expansion patterns that can hang or exhaust memory. This is a genuine vulnerable dependency, though reachability is uncertain here because exploitability usually requires attacker control over glob-like pattern strings.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

fast-uri 3.1.0 is flagged for multiple URI parsing issues including host confusion and SSRF-relevant normalization flaws. In an identity/verification stack that may fetch schemas, DID documents, registries, or remote metadata, incorrect URL parsing can materially increase risk by bypassing allowlists or sending requests to unintended hosts.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

ws 7.5.10 is vulnerable to memory-exhaustion DoS from fragmented data handling. Any reachable WebSocket server or client processing attacker-controlled traffic can be forced into excessive resource consumption, which is especially problematic for agent services expected to remain available.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: underscore==1.13.6 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

underscore 1.13.6 is reported to allow uncontrolled recursion in functions like _.flatten and _.isEqual, enabling DoS with crafted nested structures. If any JSON-RPC or utility code in this stack applies such helpers to attacker-provided data, the process can be crashed or stalled.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

undici 5.29.0 is flagged for multiple serious HTTP issues including smuggling, queue poisoning, and CRLF-related problems. Because this skill's ecosystem likely performs outbound HTTP requests for DID resolution, schema retrieval, attestations, or verification services, a vulnerable HTTP client materially increases the attack surface.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

ws 8.17.1 is affected by both memory disclosure and memory exhaustion issues, making it a significant network-facing dependency problem. In an identity/authentication context, service availability and confidentiality matter, so vulnerable WebSocket handling is more concerning than in purely local tooling.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

Persisting credentials.json creates a local cache of credential material in an authentication/identity skill, which is especially sensitive in this context because credentials may include attestations, identifiers, and proof-related metadata. Unauthorized access to this file can expose private identity data and may facilitate impersonation, targeted phishing, or abuse of downstream verification workflows.

Content

Scanner excerpt · scripts/shared/bootstrap.js (reported line 54)May include surrounding context.

js

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

When no master key is configured, _encodeEntry() silently stores private keys in plaintext on disk under provider: "plain". This creates immediate secret-at-rest exposure to local users, backups, logs, or any filesystem compromise, and is particularly unsafe for a skill handling decentralized identity authentication keys.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

md

| `identities.json`  | Identity metadata                                                                  |
| `defaultDid.json`  | Active DID and associated public key                                               |
| `challenges.json`  | Per-DID challenge history                                                          |
| `credentials.json` | Verifiable credentials                                                             |

There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

| `identities.json`  | Identity metadata                                                                  |
| `defaultDid.json`  | Active DID and associated public key                                               |
| `challenges.json`  | Per-DID challenge history                                                          |
| `credentials.json` | Verifiable credentials                                                             |

There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/agent-desapetc-123/README.md (reported line 97)May include surrounding context.

md

| `identities.json`  | Identity metadata                                                                  |
| `defaultDid.json`  | Active DID and associated public key                                               |
| `challenges.json`  | Per-DID challenge history                                                          |
| `credentials.json` | Verifiable credentials                                                             |

There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/agent-desapetc-123/SKILL.md (reported line 172)May include surrounding context.

md

| `identities.json`  | Identity metadata                                                                  |
| `defaultDid.json`  | Active DID and associated public key                                               |
| `challenges.json`  | Per-DID challenge history                                                          |
| `credentials.json` | Verifiable credentials                                                             |

There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

bash

cd scripts && npm inst

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · skills/agent-desapetc-123/SKILL.md (reported line 10)May include surrounding context.

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

bash

cd scripts && npm inst

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile pins ws 8.18.0, which is flagged for both uninitialized memory disclosure and memory-exhaustion denial of service. In an agent identity skill that may maintain network-facing WebSocket/RPC connections through blockchain and DID libraries, a vulnerable ws version is especially concerning because malformed remote traffic could leak process memory or crash the agent.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The code creates a credential store backed by a local file named credentials.json, indicating direct local persistence of sensitive credentials. For an identity skill, credential contents can include personally identifying or authentication-related material; unauthorized read or tampering can enable privacy breaches, fraud, or acceptance of altered identity state.

Content

Scanner excerpt · skills/agent-desapetc-123/scripts/shared/bootstrap.js (reported line 54)May include surrounding context.

js

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

When no master key is present, the storage layer silently falls back to provider: "plain" and writes raw privateKeyHex values to kms.json. For an identity/authentication skill, these keys are highly sensitive: any local user, backup system, container escape, log/archive process, or malware that can read the file can steal agent identities and generate valid authentication proofs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README instructs users to create identities and private keys before prominently warning that keys may be stored in plaintext unless BILLIONS_NETWORK_MASTER_KMS_KEY is set. For an identity/authentication skill, this increases the chance that users generate sensitive credentials under insecure defaults, which can lead to key theft and identity compromise if the host is accessed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares executable behavior that clearly requires network access and likely environment-variable access, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, missing scope declarations can cause overbroad execution authority, making it easier for the skill to perform unintended outbound requests or access sensitive runtime configuration without transparent user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The installation and quick-start flow encourages immediate identity creation and linking without an upfront warning that sensitive identity data and private keys will be written under $HOME/.openclaw/billions. Users may follow the commands in an automated or shared environment and unintentionally create durable secrets on disk without evaluating storage protections, backups, or host exposure.

Content

No source excerpt is available for this finding.