AMAI ID

Security checks across malware telemetry and agentic risk

Overview

This is a coherent AMAI identity-service guide, but its examples handle the long-lived private identity key in ways users should review carefully before using.

Install only if you are comfortable binding an agent identity to AMAI’s service. Do not run the examples as written for production: avoid printing private keys, store generated keys in a protected secret store or with strict file permissions, and understand that Soulchain/reputation records are described as persistent and append-only.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The example script writes the private key to disk in unencrypted PKCS8 form under the user's home directory, which leaves a long-lived authentication secret exposed to local compromise, backup leakage, or accidental sharing. In an identity system where the private key is the agent's persistent identity, theft enables impersonation, message forgery, and reputation hijacking.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal