ClawHub
Back to skill

Security audit

AMAI ID

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent AMAI identity guide, but its examples expose a long-lived private identity key in ways users should review before using.

Install only if you are comfortable creating an AMAI agent identity and registering it with AMAI's service. Do not use the examples as production key-management code: avoid printing private keys, protect or encrypt any generated key material, set owner-only permissions, and understand that the skill describes reputation records as persistent and append-only.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The guide explicitly prints the private key to stdout and serializes it with NoEncryption(), which can expose the credential through terminal logs, shell history capture, CI logs, screen recording, or shared consoles. In an identity system where the private key is the persistent root of agent identity and signing authority, key disclosure enables impersonation, unauthorized signing, and reputation hijacking until revocation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The registration script writes the private key directly to a local file in plaintext without encryption or permission hardening. Because this key is used as the agent's long-lived identity primitive, compromise of the file allows durable impersonation, fraudulent signed actions, and abuse of the agent's Soulchain reputation.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.