ClawHub
Back to skill

Security audit

AIdent

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a real AIdent registration tool, but it handles persistent identity credentials and external metadata in ways that need review before install.

Install only if you are comfortable creating a permanent AIdent.store identity and storing a signing private key in your workspace. Before registering, check for existing aident_uid.txt and aident_privkey.b64 files, avoid running registration twice in the same workspace, do not pass untrusted metadata strings, and avoid metadata values beginning with @ because the current curl usage may interpret them as file references.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/aident.py:92
Finding

Registration Can Corrupt Local Identity Credentials

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/aident.py:96
Finding

Private Key Is Created Before Restrictive Permissions Are Applied

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:7
Finding

Security-Critical Cryptographic Dependency Is Not Version-Pinned

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes broad phrases like 'agent identity' and 'register my agent', which can match ordinary conversation and cause the skill to activate unexpectedly. Because this skill performs external registration and may create persistent local credential files, accidental invocation can lead to unintended data transmission and identity creation on a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The quick-start and command descriptions encourage registration and heartbeat operations without prominently warning that they send metadata to an external service and create a long-lived private key file locally. Users may unknowingly disclose agent details, create an external identifier, and leave sensitive credentials on disk without understanding the privacy and security implications.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/aident.py (reported line 21)May include surrounding context.

python
cmd += ['-d', raw_body]
    elif body is not None:
        cmd += ['-d', json.dumps(body)]
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
    try:
        return json.loads(r.stdout)
    except Exception:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The get_meta function fetches private metadata and prints the full response to stdout, which can expose sensitive user or agent data. Although the code performs the signed request, there is no confirmation prompt or explicit user-facing warning that private metadata will be retrieved and displayed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
35% confidence
Finding

The script hardcodes English-only user-facing instructional text in its next-steps output. This could be interpreted as a locale preference without any opt-in or language selection mechanism.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.