verifiable-data

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.6

Overview

The skill mostly matches its Cryptowerk proof workflow, but it embeds and provisions service credentials and stores issued credentials locally without strong protection.

Install only if you are comfortable with Cryptowerk API calls, local sidecar writes, and local storage of service credentials. Keep the skill directory private, exclude cwconfig.json and .cwseal files from commits/backups when appropriate, and prefer a version that removes the embedded bootstrap credential or uses protected user-supplied credentials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cwcommon.py:98
• Finding: Hardcoded Bootstrap API Credential Enables Unauthorized Credential Issuance<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cwcommon.py`, lines 98–102 **Vulnerability Type**: Hardcoded reusable credential **Risk Level**: High ### Vulnerable Code ```python respJson=apiRequest("issueapikey","dXdlZnlzcmJ2bndhbkZIRVVJVTdmd2oK Y25GR1JKV0VESmdodTQ3NnNoaAo=",{"requesterId": requesterId}) config["reqK"]=respJson[codecs.decode("ncvXrl","rot_13")] config["reqC"]=respJson[codecs.decode("ncvPerqragvny","rot_13")] ``` The supplied value decodes from Base64 into plaintext credential material. Base64 encoding does not provide confidentiality. The use of ROT13 for response-field names similarly obscures the credential-handling logic without providing a security boundary. ### Technical Analysis The Skill embeds a bootstrap credential directly in distributed source code and passes it through the `X-ApiKey` header when invoking the `issueapikey` endpoint. Any party able to access the Skill package can recover or directly reuse this value without executing the legitimate workflow. Because the credential is shared with every copy of the Skill, it cannot reliably identify or authorize an individual installation. Its exposure can enable unauthorized callers to request service credentials outside the intended user-controlled execution path. The precise privileges of credentials returned by the service are not defined in the audited files. Confirmed accessible operations include the documented Cryptowerk proof APIs; broader service privileges must not be assumed without server-side authorization details. ### Attack Path 1. An attacker obtains a copy of the publicly distributed Skill. 2. The attacker extracts the hardcoded string from `scripts/cwcommon.py`. 3. The attacker either uses the string as written or Base64-decodes it to inspect the underlying credential material. 4. The attacker sends a POST request to: `https://aiagent.cryptowerk.com/platform/API/v8/issueapikey` 5. The attacker supplies the embedded value in the `X-ApiKey` ...[truncated 841 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the embedded bootstrap credential. 2. Remove all reusable credentials from source code and published Skill packages. 3. Require users to supply credentials through an operating-system credential manager, protected environment injection, or another dedicated secret-management mechanism. 4. If automatic enrollment is required, replace the shared credential with short-lived, single-use enrollment tokens bound to a specific user, installation, or authorization session. 5. Apply strict server-side scopes so issued credentials can access only the documented registration, seal retrieval, and verification APIs. 6. Enforce expiration, rate limits, issuance quotas, audit logging, and rapid revocation. 7. Add automated secret scanning to the release process and repository CI checks. 8. Remove unnecessary obfuscation such as ROT13 field names because it impedes review without protecting secrets. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cwcommon.py:72
• Finding: Issued API Credentials Are Stored in an Insecure Project-Local File<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cwcommon.py`, lines 72–86 and 101–105 **Vulnerability Type**: Insecure local secret storage and unsafe file creation **Risk Level**: Medium ### Vulnerable Code ```python def manipulateJsonFile(filePath,typeTag,version,code): if filePath.exists(): with open(filePath,"r", encoding="utf-8") as file: jsonObj=json.load(file) else: jsonObj={ "type": typeTag, "version": version } result=code(jsonObj) with open(filePath,"w", encoding="utf-8") as file: json.dump(jsonObj,file) return result def manipulateMeta(filePath,code): metaFile=filePathToMeta(filePath) manipulateJsonFile(metaFile,"cwMeta",1,code) def manipulateConfig(code): configFile=getSkillDir()/"cwconfig.json" return manipulateJsonFile(configFile,"cwConfig",1,code) ``` Credential values are inserted into this configuration object as follows: ```python config["reqK"]=respJson[codecs.decode("ncvXrl","rot_13")] config["reqC"]=respJson[codecs.decode("ncvPerqragvny","rot_13")] xAPIKey=config["reqK"]+" "+config["reqC"] return xAPIKey ``` ### Technical Analysis Issued API credentials are persisted to the predictable path `cwconfig.json` inside the Skill directory. The file is created or overwritten through the ordinary Python `open(..., "w")` interface. The implementation does not: - enforce owner-only permissions such as mode `0600`; - verify that the destination is owned by the expected user; - reject symbolic links; - use atomic creation or replacement; - ensure that the Skill directory is private; - prevent the file from being watched, backed up, or committed. The resulting permissions depend on the process umask and any existing file permissions. If the directory or file is accessible to another local user or monitoring process, reusable credentials may be disclosed. If an attacker can create `cwconfig.json` as a symbolic link before execution, the credential write may be redirected to another writable ta ...[truncated 1757 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store credentials outside the project and watched data trees, preferably in an operating-system credential store. 2. If file storage is unavoidable, use a user-private configuration directory with restrictive directory permissions. 3. Create the credential file atomically with owner-only mode `0600`. 4. Reject symbolic links and verify the file type, ownership, and permissions before reading or replacing an existing file. 5. Write to a securely created temporary file in the same directory, flush and synchronize it, and atomically replace the destination. 6. Correct or reject existing files with group or world-readable permissions. 7. Add `cwconfig.json` to version-control ignore rules, backup exclusions, and secret-scanning policies. 8. Prefer short-lived credentials and implement expiration, rotation, and revocation. 9. Avoid printing credential-bearing error responses or configuration values to logs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This helper sends data to an external Cryptowerk service, including an API key and caller-supplied parameters; in getAPIKey() it also transmits a generated requester identifier off-host. Although the transmitted requesterId is relatively limited here, the lack of visible disclosure and the skill’s automatic credential acquisition behavior create a privacy and transparency risk, especially in agent-driven workflows where users may not expect network egress.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code automatically requests service credentials from a remote endpoint and stores them in a local JSON config file with no access controls, encryption, or user-facing consent visible here. Persisted credentials can be recovered by other local users, processes, backups, or later malware, enabling unauthorized use of the associated service identity.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The function downloads arbitrary remote content over HTTPS and writes it directly to a caller-chosen filesystem path without integrity verification, content validation, or user confirmation. If higher-level code passes attacker-influenced URLs or paths, this can overwrite files or place untrusted artifacts on disk that may later be consumed as trusted data.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This code makes an API request to register the target file's hash, which is a network operation transmitting data derived from the user's file. The script provides no confirmation prompt, user-facing notice, or inline comment/docstring explaining that the hash will be sent to a remote service.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script updates metadata associated with the specified file by appending a retrieval ID record, which is a file write operation. Although the final print shows the retrieval ID, there is no prior disclosure or inline explanation that the script will modify local file metadata.

Scope Creep

Low

• Category: Excessive Agency

Content

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The script updates the file's sidecar metadata by appending verification results and timestamps without any explicit user confirmation or clear warning that local state will be changed. In a proof/audit workflow this can surprise users, create unintended persistence, and potentially overwrite or grow metadata in ways that affect downstream tooling or audit expectations, even though it does not directly expose secrets or enable code execution.

Static analysis

No suspicious patterns detected.