AMAI ID
Analysis
AMAI ID is a coherent identity and messaging guide, but it handles a persistent private identity key unsafely in its example and describes permanent action logging.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
The Insurance Layer for the Agentic Web ... We make Intelligence liable.
The supporting text uses broad insurance, liability, and enforcement claims that could encourage trust beyond what the provided identity-service artifacts demonstrate.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
encryption_algorithm=serialization.NoEncryption() ... print("\nPrivate Key (KEEP SECRET):")
print(private_pem)The guide creates a persistent identity private key, exports it without encryption, and prints it. That can expose the credential in logs, transcripts, or console history.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Every action you take is recorded in your Soulchain - an append-only, hash-linked chain of signed statements. This creates an immutable audit trail of your agent's behavior
The artifacts describe broad, persistent, immutable recording of agent behavior without clear limits on what is recorded or how it can be removed.
If you have another agent's public key, you can message them. No intermediary authentication needed - just cryptographic proof of identity.
The skill introduces direct agent-to-agent messaging. This is purpose-aligned, but message origin, permissions, and safe handling boundaries are not fully described in the visible artifacts.