ClawHub
Back to skill

Security audit

AGNTCY Identity CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but it asks users to install or run mutable upstream code while handling high-value OAuth and signing-key secrets.

Review and pin the upstream repository or Go module before installing, run the backend in a restricted test environment, and use only test OAuth clients and test signing-key vaults until you have verified the code path and secret-handling behavior.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:95
Finding

Unpinned Remote Repository Is Retrieved and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 95–96
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Medium

Vulnerable Code:

sh
git clone <https://github.com/agntcy/identity.git> cd identity
./deployments/scripts/identity/launch_node.sh

Technical Analysis

The instructions clone the mutable default branch of an external repository and then direct the user to execute a shell script from that repository. No release tag, commit hash, checksum, or cryptographic signature is specified. Consequently, the code executed later may differ from the code originally reviewed.

The first command is also malformed as displayed: git clone and cd identity are not separated by a newline, semicolon, or &&. Correcting this syntax would not address the underlying trust-boundary issue.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or its release workflow.
  2. The attacker modifies deployments/scripts/identity/launch_node.sh or a component launched by that script.
  3. A user follows the Skill instructions and clones the repository’s current default branch.
  4. The user executes launch_node.sh.
  5. The attacker-controlled code runs with the invoking user’s permissions and can access resources available to that process.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user running the script. Its scope may include reading or modifying user-accessible files, accessing environment variables, and stealing the OAuth credentials or signing-key vault described elsewhere in the Skill. The available project file does not establish privilege escalation beyond the invoking user.

Remediation
View remediation

Remediation Suggestions

  • Pin the repository to a reviewed release tag and immutable commit hash.
  • Verify a signed release or published checksum before executing any fetched content.
  • Review the launch script and the files it invokes before execution.
  • Run the backend in a restricted container or dedicated low-privilege environment without production credentials or signing keys.
  • Correct the example by separating the operations explicitly:
    sh
    git clone --branch "<reviewed-tag>" https://github.com/agntcy/identity.git
cd identity && git checkout "<verified-commit-hash>"
./deployments/scripts/identity/launch_node.sh

T08 · Insecure Dependencies

Warning
Location
SKILL.md:7
Finding

Go Installation Dependency Is Not Version-Pinned

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7–11
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

yaml
install:
  - id: go
    kind: go
    label: Install via go install
    module: github.com/agntcy/identity/cmd/issuer

Technical Analysis

The Go module declaration does not specify an immutable semantic version or commit. Depending on the installer’s resolution behavior, installations performed at different times may retrieve different source code. This prevents the audited Skill from guaranteeing which implementation is installed and creates a supply-chain trust dependency on mutable upstream content.

Attack Path

  1. An attacker compromises the upstream module repository, maintainer credentials, or publication workflow.
  2. A malicious version of the module is made available at the unpinned source.
  3. The Skill installer resolves and installs that changed version.
  4. The user runs the resulting identity executable.
  5. The modified executable runs with the user’s permissions and may receive OAuth secrets and access signing keys during documented workflows.

Impact Assessment

Successful exploitation may result in arbitrary code execution under the invoking user account. Because the CLI is intended to handle CLIENT_SECRET and cryptographic vault data, a compromised dependency could disclose credentials, signing keys, or issued identity artifacts. The exact resolved version and installer behavior cannot be confirmed from the reviewed file alone.

Remediation
View remediation

Remediation Suggestions

  • Pin the module to an audited semantic version or immutable commit.
  • Validate dependency integrity through the Go checksum database and trusted module proxy.
  • Prefer signed release artifacts where the upstream project provides them.
  • Record the expected version and checksum in the Skill metadata.
  • Perform dependency and provenance verification before allowing the binary to process credentials or signing keys.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:69
Finding

OAuth Client Secret Is Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69–78
Vulnerability Type: Sensitive information exposure through process arguments
Risk Level: Medium

Vulnerable Code:

sh
identity issuer register -o "My Organization" -c
"$CLIENT_ID" -s "$CLIENT_SECRET" -u "\$ISSUER_URL"
sh
identity metadata generate -c "$CLIENT_ID" -s "$CLIENT_SECRET" -u
"\$ISSUER_URL"

Technical Analysis

Both examples expand CLIENT_SECRET into the command’s argument vector. Secret-bearing arguments can be exposed to local process-inspection facilities, audit or endpoint-monitoring systems, diagnostic tooling, crash reports, and command tracing. The document’s warning not to paste secrets into logs does not prevent this process-level exposure.

The URL argument also uses "\$ISSUER_URL", which passes the literal text $ISSUER_URL rather than expanding the environment variable. This is a functional error, although it is not itself the secret-exposure vulnerability.

Attack Path

  1. A user exports a valid CLIENT_SECRET.
  2. The user runs one of the documented commands.
  3. The shell expands the secret into the new process’s argument vector.
  4. A local user, privileged monitoring agent, audit facility, tracing tool, or diagnostic collector captures the arguments.
  5. An attacker retrieves and reuses the exposed credential against the configured identity provider, subject to its assigned scopes and policies.

Impact Assessment

Exploitation can disclose the OAuth/OIDC client secret. An attacker may authenticate as the configured client and obtain whatever access its grants, scopes, and identity-provider policies allow. The precise privileges cannot be determined from SKILL.md; they depend on external IdP configuration. The issue does not by itself demonstrate system-level privilege escalation.

Remediation
View remediation

Remediation Suggestions

  • Do not pass client secrets through command-line arguments.
  • Modify or configure the CLI to read secrets from standard input, a permission-restricted file, an operating-system credential store, or a secret-manager reference.
  • Ensure secret files are owned by the intended user and have restrictive permissions such as 0600.
  • Disable shell tracing while handling secrets and review telemetry, audit, and crash-reporting configurations for argument capture.
  • Redact secrets from application logs and error messages.
  • Correct the URL argument to "$ISSUER_URL" so that the intended value is expanded.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md
1. Install CLI
2. Start Node Backend
3. Create vault + keys
4. Register Issuer
5. Generate metadata
6. Issue badge

Static analysis

No suspicious patterns detected.