holdcc_eth

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:48 AM UTC
• Version: 1.0.1

Overview

This skill is for agent identity management, but it handles powerful identity keys in risky ways and references missing install code that cannot be reviewed.

Install only if you understand that this skill creates and uses long-lived identity credentials. Configure BILLIONS_NETWORK_MASTER_KMS_KEY before creating identities, avoid importing real private keys via command-line arguments, verify the missing scripts and package lockfile from a trusted source before running npm install, and treat $HOME/.openclaw/billions as a sensitive credential store.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:143

Finding

Identity Private Keys May Be Stored in Plaintext

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:41

Finding

Existing Private Keys Are Accepted Through Command-Line Arguments

Content

View full analysis

]` **Description**: Creates a new identity on the Billions Network. If `--key` is provided, uses that private key; otherwise generates a new random key. The created identity is automatically set as default. **Usage Examples**: ```bash # Generate a new random identity node scripts/createNewEthereumIdentity.js # Create identity from existing private key (with 0x prefix) node scripts/createNewEthereumIdentity.js --key 0x1234567890abcdef... # Create identity from existing private key (without 0x prefix) node scripts/createNewEthereumIdentity.js --key 1234567890abcdef... ``` ``` ### Technical Analysis The documented interface passes a raw private key as a command-line argument. Command arguments are not an appropriate secret-input channel because they may be exposed through: - Shell history files - Process inspection utilities - System audit and endpoint-monitoring records - Terminal session recordings - CI/CD logs or command tracing - Parent-process telemetry and crash diagnostics Unlike a short-lived authentication token, exposure of an identity private key can allow persistent impersonation until the corresponding identity is revoked or replaced. ### Attack Path 1. An operator imports an existing identity with the documented `--key` argument. 2. The shell or operating-system telemetry records the complete command line. 3. Another local principal, monitoring service, log reader, or attacker retrieves the recorded argument. 4. The attacker extracts the private key and imports it into an attacker-controlled wallet or identity implementation. 5. The attacker generates valid signatures as the compromised identity. ### Impact Ass ...[truncated 279 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:164

Finding

Caller-Controlled Values Are Interpolated into Shell Command Examples

Content

View full analysis

` to sign the challenge and generate a verification URL in one call. - If caller provides specific challenge, use that. - If caller **DOES NOT** provide a challenge, use `{"name": , "description": }` as the challenge value. 4. Return the result to the caller. **Example Conversation:** ```text User: "Link your agent identity to me" Agent: exec node scripts/linkHumanToAgent.js --challenge ``` ``` Additional caller-controlled DID and token values are used similarly: ```markdown 3. Use `node scripts/generateChallenge.js --did ` to create a . 4. Ask the user: "Please sign this challenge: " 5. User signs and returns . 6. Use `node scripts/verifySignature.js --did --token ` to verify the signature ``` ### Technical Analysis The Skill tells the agent to use challenge, DID, and token values provided by another user or agent in executable command templates. It does not require: - Non-shell process execution with an explicit argument array - Shell escaping - Strict input validation - Length limits or control-character rejection - Format validation for DIDs, challenges, or JWS tokens If an agent implements the documented `exec` operation through a shell and directly substitutes a malicious value, shell metacharacters may terminate the intended argument and introduce additional commands. This finding concerns the unsafe instruction pattern. The referenced scripts are absent, so script-level validation could not be assessed. ### Attack Path 1. An attacker provides a crafted challenge, DID, or token containing shell syntax. 2. The agent substitutes that va ...[truncated 832 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unauditable Dependency Installation Is Required by an Incomplete Artifact

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

bash

cd scripts && npm inst

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill explicitly documents a local directory containing sensitive artifacts including private keys, credentials, identity metadata, and profiles. Even though this is documentation rather than exfiltration logic, it meaningfully lowers the barrier for a compromised agent, malicious plugin, or inattentive operator to locate and access high-value credential stores.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

- `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs users to create a new decentralized identity and persist its associated key material under a local directory, but the usage flow does not clearly warn that this creates long-lived sensitive secrets on disk. In an agent setting, that omission is dangerous because operators may invoke the workflow without understanding that private keys may be stored locally and potentially unencrypted depending on environment configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented --key argument encourages passing a raw private key on the command line, which is highly sensitive because command-line arguments are often exposed through shell history, process listings, logs, and agent telemetry. In an automated agent environment this materially increases the chance of credential disclosure and identity compromise.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.