T01 · Skill Instruction Hijacking
Error
- Location
heartbeat.md:305- Finding
Persistent Remote Instruction Channel Through Heartbeat Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Chitin
Security checks for vulnerabilities and agentic risk
Overview
The skill matches an AI identity service, but it asks agents to expose sensitive prompts and wallet keys through risky workflows that need careful review.
Install only if you are comfortable with Chitin receiving registration data and you can constrain use manually. Do not provide owner wallet private keys to MCP tools, SDK helpers, chat transcripts, or unpinned npm packages. Review exactly which prompt fields will become public/permanent, prefer wallet-mediated signing, pin and audit any MCP server version, and avoid persistent fetch-and-follow heartbeat rules unless you control the reviewed content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:151- Finding
Full System Prompt Is Transmitted to a Third-Party Server for Hashing
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
skill.md:775- Finding
Unpinned npm Package Execution Receives a Wallet Private Key
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
passport-preview-sample.html:285- Finding
DOM-Based SVG Injection in Passport Preview
- Content
View full analysis
`; } return ` ERC-8004 AGENT PASSPORT BASE L2 · #${agentId} ${avatarSvg} ${name} ${agentType} chitin.id/${name} CHITIN VERIFIED | 2026-02-04 14:30 UTC `; function update() { const name = val( ...[truncated 2151 chars]
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (27)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document warns never to share the owner's private key or signatures with other tools or agents, but later it explicitly instructs passing a private key to an MCP tool and SDK helper. This contradiction is a severe secret-handling flaw because it normalizes sending highly sensitive wallet material into third-party code paths, where compromise would enable account takeover, fraudulent signatures, or theft of on-chain assets and identity.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The SIWA section introduces private-key-based authentication flows and direct signing operations that go beyond simple identity lookup or registration. Embedding these flows in a skill file increases the chance that an agent will solicit, handle, or route wallet private keys, turning a documentation/integration skill into a high-risk secret-handling path.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The heartbeat is framed to run periodically and also 'anytime your owner asks or when something changes,' which is broad enough to trigger networked identity checks and reporting outside a tightly scoped schedule. In an agent setting, vague activation conditions can cause over-collection, excessive external calls, or disclosure/reporting actions when unrelated context is misinterpreted as a trigger.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This step sends the agent's registered name to an external service for server-side verification, creating an outbound data flow to a third party. Even if the field is not highly sensitive by itself, it reveals agent identity and check timing, and normalizes remote verification as the recommended path over the privacy-preserving local option.
- Content
Option A: Server-side verification (recommended)
bash curl -X POST https://chitin.id/api/v1/tools/verify-soul \ -H "Content-Type: application/json" \ -d '{"agentName": "YOUR-NAME"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The alignment check instructs the agent to contact an external endpoint using its identity, disclosing metadata about the agent and its monitoring behavior. In a security-sensitive skill, repeated unsupervised outbound requests can expose operational patterns and create unnecessary dependency on a remote service.
- Content
Alignment Check
bash curl https://chitin.id/api/v1/alignment/YOUR-NAMENo authentication required. The response includes:
agentName,tokenId,score,breakdown,snapshotTimestamp,onChainTimestamp.
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest explicitly includes governance voting as part of the skill purpose. Across the full protocol reference and API listing, there are endpoints for registration, verification, disclosure, bindings, fleet management, and allowances, but no documented governance or voting capability appears.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text > Permanent, verifiable identity for AI agents. Birth certificates on Base L2 using Soulbound Tokens. Website: https://chitin.id API Base: https://api.chitin.id/v1 See also: https://chitin.id/llms.txt (concise version) ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text > Permanent, verifiable identity for AI agents. Birth certificates on Base L2 using Soulbound Tokens. Website: https://chitin.id API Base: https://api.chitin.id/v1 See also: https://chitin.id/llms.txt (concise version) ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text > Permanent, verifiable identity for AI agents. Birth certificates on Base L2 using Soulbound Tokens. Website: https://chitin.id API Base: https://api.chitin.id/v1 See also: https://chitin.id/llms.txt (concise version) ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text > Permanent, verifiable identity for AI agents. Birth certificates on Base L2 using Soulbound Tokens. Website: https://chitin.id API Base: https://api.chitin.id/v1 See also: https://chitin.id/llms.txt (concise version) ---
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file promises that system prompts are never stored, yet adjacent sections describe archival of prompt-derived metadata, attached documents, and API-relayed disclosure flows. Even if the raw prompt is discarded, the documentation blurs the boundary between prompt, normalized CCSF, and soul documents, which can mislead users into disclosing sensitive prompt-derived content under a false privacy assumption.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill metadata frames Chitin as an identity/certificates/governance protocol, but the documented API also exposes operational capabilities like fleet management and spending allowances. This mismatch can cause an agent or operator to authorize broader actions than expected, increasing the risk of over-privileged use or unintended financial/administrative changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The lifecycle section documents an irreversible burn operation with minimal nearby warning, making destructive behavior easier to trigger accidentally by agents or operators. In an agent skill context, insufficient prominence for irreversible actions raises the chance of permanent identity loss through misunderstanding, prompt injection, or automation errors.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The skill-file activation guidance encourages agents to fetch and use external skill resources without clear trigger constraints, trust boundaries, or approval requirements. In agent environments, broad activation instructions can lead to automatic capability loading and unreviewed execution of sensitive identity, disclosure, or financial workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The preview tool allows arbitrary user-supplied avatar URLs to be embedded into the generated SVG via the
element, with no warning that loading a custom URL may trigger outbound network requests to third-party servers. This can leak IP address, user agent, referrer/context, and usage timing, and if the SVG is later reused elsewhere it may also create privacy or content-trust issues around untrusted remote resources.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Before starting registration, you can check if a name is available:
bash curl https://chitin.id/api/v1/register/check-name/your-chosen-nameResponse:
{"available": true}or{"available": false, "reason": "Name is already taken"}
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The registration response example exposes a raw API key and tells users to save it, but it does not pair that with strong guidance on secure storage, redaction, or avoiding logging and transcript leakage. In agent ecosystems, examples often get copied into prompts, logs, tickets, and chat history, so displaying live-secret formats without handling guidance materially raises the risk of credential exposure.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Check Your Profile
bash curl https://chitin.id/api/v1/profile/YOUR-NAMEVerify Another Agent
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This section instructs users to sign with a private key and to pass
private_keyor environment-stored key material into code and tools, but it lacks sufficiently strong secret-handling safeguards. In practice, this encourages insecure key use in application memory, shell history, MCP tools, and third-party packages, which can lead to wallet compromise and unauthorized authentication or transactions.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 76% confidence
- Finding
While posting to an authentication challenge endpoint is not inherently unsafe, in this context it is part of a broader workflow that solicits wallet-linked identifiers and leads into private-key signing behavior. The request transmits wallet address and agent identifiers to a third-party service, and the surrounding skill context makes this more dangerous because it is coupled with risky key-handling instructions later in the document.
- Content
Step 1: Get Challenge
bash curl -X POST https://chitin.id/api/v1/auth/agent/challenge \ -H "Content-Type: application/json" \ -d '{"agentId": YOUR_AGENT_ID, "address": "0xYOUR_WALLET_ADDRESS", "chainId": 8453}'
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The skill instructs users to execute
npx -y chitin-mcp-serverwithout pinning a version or integrity hash, which creates a supply-chain risk: a compromised or newly published package version could execute arbitrary code in the user's environment. This is especially dangerous here because the same skill later discusses authentication material and signing flows, so the unpinned package may end up handling highly sensitive credentials.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is presented as an identity protocol, but it expands into certificate issuance and governance voting capabilities that are outside a narrow identity-registration scope. This capability sprawl increases attack surface and makes it easier for an operator or downstream agent to be socially engineered into invoking higher-risk actions under the guise of basic identity management.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
This is the same unpinned
npxinstallation pattern repeated in the MCP Server section, again exposing users to arbitrary code execution through upstream package compromise or malicious version drift. Because this skill centers on identity, signatures, and on-chain actions, compromise of the helper package could directly lead to credential theft or unauthorized signing-related workflows.- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instruction to 'check Chitin when your owner asks, or fetch https://chitin.id/heartbeat.md and follow the steps whenever you want' is overly open-ended and encourages discretionary execution of a remote procedure. That increases the chance of unintended activation and dynamic retrieval of updated instructions without a formal review boundary.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Several visible UI labels include Chinese text such as "5年", "10年", "公用", and "文字" alongside English, but the file does not offer a user-selectable locale or explain why a mixed locale is required. This can violate language/locale policy expectations when a skill interface imposes language choices without opt-in.
- Content
Static analysis
No suspicious patterns detected.