ClawHub
Back to skill

Security audit

certen

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing CERTEN on-chain actions, but it asks users to create and persist unencrypted signing and API credentials that could authorize financial actions if leaked.

Install only if you are comfortable giving the agent a persistent CERTEN identity capable of submitting chain actions. Use a dedicated low-value/testnet identity first, avoid persisting raw key and API config files in shared workspaces, and require explicit per-action approval before any identity, transaction, governance, or funding command.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared description emphasizes giving the agent a CERTEN identity and allowing it to execute proof-gated actions while never spending without explicit owner consent. The supplied code does not perform action execution at all. Instead, it gathers status information via `certen whoami`, `certen identity list`, `certen identity get`, and `certen balance`, then outputs a JSON summary of organization, identities, chain accounts, and spendability/enforcement state. This is a diagnostic/introspection script, not an action-execution or consent-enforcement mechanism. While balance and enforcement status are related to spending context, the code neither spends funds nor implements explicit owner-consent gating, so the description materially overstates and mischaracterizes the behavior.

Credential Access

High
Category
Privilege Escalation
Content
```bash
certen keys generate --name agent --no-passphrase        # an Ed25519 key that never leaves this machine
certen signup --with-key agent --org-name <owner>-<handle> --no-keyring --json
certen doctor --json                                     # names the one thing blocking you, if any
```
Confidence
91% confidence
Finding
The skill instructs generation of an agent signing key with `--no-passphrase` and stores long-lived material in predictable local paths under `~/.certen`, then advises persisting those files across sessions. In an agent or shared/containerized environment, an unencrypted private key on disk can be copied by other processes, compromised tooling, or workspace leakage, allowing unauthorized signing and submission of proof-gated actions tied to the identity.

Credential Access

High
Category
Privilege Escalation
Content
```bash
certen keys generate --name agent --no-passphrase        # an Ed25519 key that never leaves this machine
certen signup --with-key agent --org-name <owner>-<handle> --no-keyring --json
certen doctor --json                                     # names the one thing blocking you, if any
```
Confidence
91% confidence
Finding
The skill instructs generation of an agent signing key with `--no-passphrase` and stores long-lived material in predictable local paths under `~/.certen`, then advises persisting those files across sessions. In an agent or shared/containerized environment, an unencrypted private key on disk can be copied by other processes, compromised tooling, or workspace leakage, allowing unauthorized signing and submission of proof-gated actions tied to the identity.

Static analysis

No suspicious patterns detected.