V Identity Ilhant34

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:27 AM UTC
• Version: 1.0.0

Overview

This identity skill is mostly purpose-aligned, but it should be reviewed carefully because it can store high-value private identity keys locally in plaintext by default.

Install only if you are comfortable creating a persistent agent DID and storing its private keys on this machine. Set BILLIONS_NETWORK_MASTER_KMS_KEY before creating or importing an identity, run it in an isolated account or environment, protect $HOME/.openclaw/billions, and treat old signed challenge tokens as reusable unless the implementation is changed to expire and consume them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/shared/storage/keys.js:47

Finding

Private identity keys are stored unencrypted by default

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/verifySignature.js:19

Finding

Authentication challenges can be replayed indefinitely

Content

View full analysis

entry.did === did); if (index >= 0) { // Update existing entry entries[index] = { did, challenge, created_at }; } else { // Add new entry entries.push({ did, challenge, created_at }); } await this.writeFile(entries); } async find(did) { const entries = await this.readFile(); return entries.find((entry) => entry.did === did); } async getChallenge(did) { const entry = await this.find(did); return entry?.challenge; } ``` Verification compares the signed value with the stored challenge but neither checks its age nor consumes it after success: ```js // Get the stored challenge const challenge = await challengeStorage.getChallenge(args.did); if (!challenge) { console.error(`Error: No challenge found for DID: ${args.did}`); console.error("Generate a challenge first with generateChallenge.js"); process.exit(1); } // Create DID resolver that fetches from remote resolver const resolveDIDDocument = { resolve: async (did) => { const resp = await fetch( `https://resolver.privado.id/1.0/identifiers/${did}`, ); const didResolutionRes = await resp.json(); return didResolutionRes; }, }; // Create JWS packer and unpack token const jws = new JWSPacker(kms, resolveDIDDocument); const basicMessage = await jws.unpack(byteEncoder.encode(args.token)); // Verify the sender if (basicMessage.from !== args.did) { console.error( `Error: Invalid from: expected from ${args.did}, got ${basicMessage.from}`, ); process.exit(1); } ...[truncated 2320 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The stated purpose focuses on identity verification and attestation, but the skill also performs local private-key storage, persistence, and key-management operations. That mismatch can mislead users and agent frameworks into approving a skill with far more sensitive authority than its description suggests, enabling unexpected credential handling and long-term secret retention.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

bash

cd scripts && npm inst

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill explicitly handles sensitive credential material, including private keys and verifiable credentials stored on disk. In context, identity tooling must process credentials, but storing them locally—especially with optional plaintext key storage—creates a high-value target for theft, misuse, or lateral access by other tools/processes.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

- `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile includes ws 8.18.0, which is flagged for memory disclosure and memory-exhaustion denial of service issues. In an identity/authentication skill that may handle websocket-based RPC or provider traffic, remotely triggerable DoS or memory exposure in a networking library is a meaningful supply-chain risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.1.0 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

brace-expansion 2.1.0 is flagged for multiple denial-of-service conditions caused by pathological expansion behavior and memory growth. Although often used in tooling or parsing paths, any reachable processing of attacker-controlled patterns can lead to CPU or memory exhaustion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

fast-uri 3.1.0 is reported for several URI parsing and canonicalization issues including host confusion and SSRF-related edge cases. Because this skill interacts with decentralized identity documents, registries, and remote resources, malformed URI handling could make trust or fetch decisions against the wrong host.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

ws 7.5.10 is reported vulnerable to memory exhaustion from tiny fragments and data chunks, enabling denial of service via malicious websocket traffic. Since the dependency tree includes RPC and provider components, websocket exposure is plausible and makes this more relevant than a purely build-time issue.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: underscore==1.13.6 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

underscore 1.13.6 is flagged for unlimited recursion in functions like _.flatten and _.isEqual, which can crash or hang a process on crafted deeply nested input. In services processing external credential, DID, or RPC data, this can become a reachable availability issue if these helpers are invoked on attacker-controlled structures.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

undici 5.29.0 is associated with numerous HTTP parsing and request/response handling issues, including smuggling, queue poisoning, and CRLF-related flaws. This is especially concerning for an identity skill that likely fetches remote documents or communicates with registries and verifiers, where outbound HTTP trust boundaries matter.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

ws 8.17.1 is another vulnerable websocket library instance affected by memory disclosure and memory exhaustion DoS issues. Multiple vulnerable websocket copies in the dependency tree broaden the attack surface and increase the chance that at least one reachable code path remains exploitable.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The lockfile includes ws 8.18.0, which is flagged for uninitialized memory disclosure and memory-exhaustion denial of service. This is especially relevant because the skill depends on networking-heavy identity, blockchain, and websocket-capable libraries; if the skill opens websocket connections to untrusted peers or relays, an attacker may be able to crash the process or potentially expose process memory.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

md

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/shared/bootstrap.js (reported line 54)May include surrounding context.

js

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code silently falls back to writing plaintext private keys to kms.json without any warning, consent, or hard failure when key encryption is not configured. This creates a high-risk secret exposure path that operators may not realize exists, especially dangerous here because the keys back identity verification and authentication proofs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx clawhub@latest install verified-agent-identity, which pulls and executes the latest published package version at install time. This creates a supply-chain risk because a compromised or malicious future release of clawhub could execute arbitrary code on the host during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This installation command again relies on npx clawhub@latest, causing users to execute whatever code is published in the newest package version. In an identity-management skill that handles keys and credentials, this is especially sensitive because installer compromise could steal secrets or backdoor the environment before the skill is even used.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares executable behavior that can use environment variables and communicate with external registries, but it does not declare an explicit tool/permission scope. In an agent setting, this weakens operator visibility and policy enforcement, increasing the chance the skill is invoked with broader capabilities than users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The setup instructions tell users to create an identity before prominently warning that private keys may be stored locally in plaintext when no master KMS key is configured. This can cause accidental insecure key creation, especially in automated agent environments where users may never review later security notes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The linking workflow encourages challenge signing and identity linking without an upfront notice that DIDs, challenges, credentials, and related artifacts are persisted under the user's home directory. In a shared or managed agent runtime, that persistence can expose sensitive identity metadata or leave durable authentication artifacts behind.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

When no master key is configured, _encodeEntry stores privateKeyHex directly on disk in plaintext. For an identity/authentication skill, exposure of private keys enables full impersonation, proof forgery, and persistent compromise of agent identity, so the skill context makes this more dangerous rather than less.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The list() method returns full private key material for every stored entry, unnecessarily broadening access to the most sensitive secret in the system. In a decentralized identity skill, listing private keys directly increases the blast radius of any misuse, logging leak, or downstream caller compromise because it exposes all agent identities at once.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==13.0.0 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

uuid 13.0.0 is present and is reported vulnerable when v3/v5/v6 APIs are called with a caller-provided buffer lacking proper bounds checks. This is lower severity and may not be reachable in normal use, but it is still a real dependency risk if any code path passes attacker-influenced buffer arguments.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==9.0.1 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

uuid 9.0.1 is also present and carries the same bounds-check weakness for certain namespace UUID generation APIs when buf is supplied. Multiple vulnerable versions in the tree increase maintenance risk even if exploitation requires a specific call pattern.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ajv==8.17.1 — 1 advisory(ies): CVE-2025-69873 (ajv has ReDoS when using `$data` option)

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

ajv 8.17.1 is reported vulnerable to ReDoS when the $data option is enabled, which can let crafted inputs consume excessive CPU during schema validation. In an identity-verification stack that may validate externally supplied claims or credential payloads, this can become a practical availability issue if that option is used.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: elliptic==6.6.1 — 1 advisory(ies): CVE-2025-14505 (Elliptic Uses a Cryptographic Primitive with a Risky Implementation)

Low

• Category: Supply Chain
• Confidence: 79% confidence

Finding

elliptic 6.6.1 is identified as using a risky cryptographic implementation, which is concerning in a package set centered on authentication, keys, and proofs. Even when no active exploit is evident from the lockfile alone, weak crypto dependencies in identity-related code deserve treatment as real risk.

Content

No source excerpt is available for this finding.