Irenk_FNG

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:34 AM UTC
• Version: 1.0.0

Overview

This identity skill is purpose-aligned but needs Review because it handles long-lived private identity keys with unsafe documented defaults and incomplete executable artifacts.

Install only after reviewing the actual plugin scripts and dependencies. Configure BILLIONS_NETWORK_MASTER_KMS_KEY before creating any identity, avoid importing private keys with --key on the command line, and treat $HOME/.openclaw/billions as highly sensitive because compromise of kms.json could let someone impersonate the agent identity.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:33
• Finding: Private Key Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 33–45 **Vulnerability Type**: Private key exposure through process arguments and command history **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### createNewEthereumIdentity.js **Command**: `node scripts/createNewEthereumIdentity.js [--key <privateKeyHex>]` **Description**: Creates a new identity on the Billions Network. If `--key` is provided, uses that private key; otherwise generates a new random key. The created identity is automatically set as default. **Usage Examples**: ```bash # Generate a new random identity node scripts/createNewEthereumIdentity.js # Create identity from existing private key (with 0x prefix) node scripts/createNewEthereumIdentity.js --key 0x1234567890abcdef... # Create identity from existing private key (without 0x prefix) node scripts/createNewEthereumIdentity.js --key 1234567890abcdef... ``` ``` ### Technical Analysis The documented workflow passes a private identity key directly through the `--key` command-line argument. Command-line arguments are not an appropriate secret-delivery mechanism because they can be retained or exposed through: - Shell history files - Process inspection facilities - Terminal session recordings - Agent execution logs - Debugging and observability systems - Command auditing facilities Although the corresponding script is absent from the supplied project and its implementation cannot be reviewed, the documented interface itself explicitly requires the secret to be placed in the command line. The exposure occurs before the script can apply any internal protection. ### Attack Path 1. A user follows the documented example and imports an existing private key using `--key`. 2. The complete command, including the private key, is recorded in shell history, an execution log, or process metadata. 3. A local user, compromised process, support operator, or log reader ...[truncated 682 chars]
• Remediation: ## Remediation Suggestions - Remove support for supplying private keys through command-line arguments. - Accept imported keys through protected standard input or an interactive no-echo prompt. - Prefer an operating-system keychain, hardware-backed keystore, or dedicated secret-management service. - Ensure secret values are never included in application, agent, terminal, telemetry, or error logs. - Clear transient secret buffers as soon as practical after importing the key. - Update all documentation and examples so they never display private keys in commands. - Add tests that reject `--key` and verify that secret values cannot appear in process arguments. - Advise users who have already followed the documented workflow to clear relevant histories and logs and rotate potentially exposed keys.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:158
• Finding: Private Identity Keys May Be Stored in Plaintext by Default## Vulnerability Details **File Location**: `SKILL.md`, lines 158–166 **Vulnerability Type**: Plaintext storage of sensitive cryptographic material **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Security **CRITICAL - Data Storage and Protection:** The directory `$HOME/.openclaw/billions` contains all sensitive identity data: - `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext) - `defaultDid.json` - DID identifiers and public keys - `challenges.json` - Authentication challenges history - `credentials.json` - Verifiable credentials - `identities.json` - Identity metadata - `profiles.json` - Profile data ``` ### Technical Analysis The Skill explicitly states that `kms.json` contains private keys in plaintext unless the optional `BILLIONS_NETWORK_MASTER_KMS_KEY` environment variable is configured. This makes encryption opt-in rather than secure by default. Private keys are durable authentication secrets. Storing them unencrypted means that any principal able to read the file can immediately reuse them without defeating cryptographic protection. Potential readers include malicious local processes running under the same account, compromised plugins, backup readers, accidentally overprivileged users, and recipients of copied or archived home directories. The package does not contain the referenced scripts, so implementation details such as file permissions, atomic writes, key derivation, and master-key handling could not be verified. That limitation does not negate the documented plaintext fallback. ### Attack Path 1. A user creates an identity without configuring `BILLIONS_NETWORK_MASTER_KMS_KEY`. 2. The Skill stores the resulting private key in plaintext within `$HOME/.openclaw/billions/kms.json`, as documented. 3. A malicious local process, compromised agent component, backup reader, or other principal with access to t ...[truncated 647 chars]
• Remediation: ## Remediation Suggestions - Eliminate plaintext fallback behavior and require encryption for all private keys. - Refuse identity creation or import when secure key protection is unavailable. - Store keys in an operating-system credential store, hardware-backed keystore, or appropriately secured encrypted database. - If file-based encryption is unavoidable, use an authenticated encryption scheme and a strong, reviewed key-derivation mechanism. - Supply the master key through a secret manager or protected prompt rather than ordinary command-line arguments or committed configuration. - Apply restrictive directory and file permissions and verify them whenever files are created or opened. - Avoid placing unencrypted identity storage in backups, diagnostics, or synchronization systems. - Implement key rotation and revocation procedures for plaintext keys that may already have been created. - Package the referenced scripts and dependency manifests so storage behavior, permission handling, and cryptographic implementation can be independently audited.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol.
metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } }
homepage: https://billions.network/
---

## When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

### After installing the plugin run the following commands to create an identity and link it to your human DID:

```bash
cd scripts && npm inst

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Credential Access

High

• Category: Privilege Escalation

Content

- `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs users to create identities before prominently warning that private keys may be stored unencrypted unless BILLIONS_NETWORK_MASTER_KMS_KEY is configured. That can lead to long-lived credential material being written in plaintext to disk, making compromise of the host or user home directory sufficient to steal the agent identity and forge signatures.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.md:132