certen

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:19 AM UTC
• Version: 0.1.0

Overview

The skill is mostly coherent for CERTEN on-chain operations, but it asks users to create and persist sensitive signing/API credentials in ways that need careful review.

Install only if you are comfortable giving the agent CERTEN signing/API access for on-chain actions. Use a dedicated testnet identity first, avoid storing keys or config in a shared or committed workspace, prefer encrypted or access-controlled secret storage, pin and review the CERTEN CLI version, and require explicit per-action approval for every identity, transaction, value transfer, or governance command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned npm CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-11
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  openclaw:
    requires:
      bins: [node, certen]
    install:
      - kind: node
        package: "@certen.io/cli"
        bins: [certen]

Technical Analysis

The Skill declares @certen.io/cli without an exact version or integrity hash. Consequently, installation may resolve to mutable package content selected by the npm registry at installation time rather than to the specific release reviewed by the Skill author.

Because npm packages can include executable code and installation lifecycle scripts, compromise of the publisher account, package, registry resolution path, or a future release could cause attacker-controlled code to execute during installation or when the certen binary is invoked. The repository itself contains no evidence that the current package is malicious; the vulnerability is the absence of dependency pinning and integrity verification.

Attack Path

1. An attacker compromises the npm package, its publisher account, or the applicable package-resolution channel.
2. The attacker publishes a malicious release under the same package name.
3. A user installs the Skill after that release becomes the version selected by npm.
4. The installer retrieves the malicious package because no exact version or integrity value constrains resolution.
5. Malicious code executes through an npm lifecycle script or when the installed certen command is invoked.

Impact Assessment

Code supplied by a compromised dependency could execute with the privileges of the account installing or running the Skill. Within those privileges, it could access local files, environment variables, CERTEN configuration and signing-key files, workspace content, and network resources. The scope would ...[truncated 84 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @certen.io/cli to a reviewed, exact version rather than permitting mutable version resolution.
• Use a lockfile and verify the package against an expected registry integrity hash.
• Review package contents and lifecycle scripts before approving version upgrades.
• Disable npm lifecycle scripts during installation where compatible with the package.
• Retrieve dependencies only from an approved registry and use registry access controls and package-signature or provenance verification where available.
• Run installation and the CLI under a least-privileged, isolated account or container.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:56

Finding

Sensitive CERTEN Credentials Recommended for Workspace Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56-58
Vulnerability Type: Insecure storage guidance for API credentials and signing-key material
Risk Level: Medium

Vulnerable Code

markdown

**Sandboxed hosts:** if this agent runs in a container whose home directory is wiped between
sessions, `~/.certen` vanishes with it. Persist `~/.certen/keys/agent.json` and
`~/.certen/config.json` in the workspace and restore them at session start, or the identity you
created cannot be signed for.

Technical Analysis

The documentation recommends persisting ~/.certen/keys/agent.json and ~/.certen/config.json directly in the workspace. Elsewhere in the same document, the key file is described as an Ed25519 key and the configuration file as containing the API key. A general workspace is not necessarily a secret-storage boundary: it may be readable by other processes or agents, included in source-control commits, archived as a build artifact, synchronized externally, or retained in backups.

No accompanying controls require restrictive file permissions, encryption at rest, source-control exclusions, artifact exclusions, or a dedicated secret manager. As a result, following this guidance can expose persistent authentication and signing material beyond its intended trust boundary.

Attack Path

1. An operator follows the documented guidance and copies the CERTEN key and configuration files into the project workspace.
2. The workspace is committed, archived, uploaded as an artifact, backed up, or made accessible to another process or agent.
3. An unauthorized party reads agent.json and/or config.json.
4. The party uses the exposed API credential to access the associated CERTEN organization and uses available signing material to impersonate the configured agent or authorize operations permitted to that identity.
5. The exposure persists until the affected credentials are revoked or rotated.

...[truncated 555 chars]

Remediation

View remediation

Remediation Suggestions

• Do not store signing keys or API credentials in a general project workspace.
• Persist them in a dedicated secret manager, encrypted credential store, or protected persistent volume mounted only for the agent process.
• Enforce least-privilege ownership and restrictive permissions, such as owner-only read/write access.
• Add the relevant paths and filename patterns to source-control, artifact, backup, and synchronization exclusion rules.
• Encrypt credentials at rest and avoid --no-passphrase for persistent signing keys where unattended operation is not strictly required.
• Scope API credentials to the minimum permissions needed and use short-lived credentials where supported.
• Audit workspace history and generated artifacts for accidental disclosure.
• Immediately revoke and rotate credentials if either file has entered source control, logs, shared artifacts, or an untrusted workspace.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill claims it will never spend without explicit owner consent, but the file only contains natural-language guidance and no enforceable mechanism that checks for or records consent before running spending commands like identity create, call, tx create, or governance actions. In an agent setting, relying on instructions alone is unsafe because an LLM or wrapper may skip or misinterpret them, enabling unauthorized on-chain actions or costs despite the safety claim.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The setup directs generation of an agent signing key with --no-passphrase and stores it locally, then advises persisting ~/.certen/keys/agent.json and ~/.certen/config.json in the workspace. In typical agent or multi-tenant environments, unencrypted long-lived keys and persisted config/API material increase the risk of credential theft, identity takeover, and unauthorized signing of proof-gated transactions.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

bash

certen keys generate --name agent --no-passphrase        # an Ed25519 key that never leaves this machine
certen signup --with-key agent --org-name <owner>-<handle> --no-keyring --json
certen doctor --json                                     # names the one thing blocking you, if any

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/where-am-i.sh (reported line 7)May include surrounding context.

sh

# PATH and a key in ~/.certen/config.json (see SKILL.md, "One-time setup").
set -uo pipefail
command -v certen >/dev/null 2>&1 || { echo '{"error":"certen CLI not on PATH — npm i -g @certen.io/cli"}'; exit 2; }
who=$(certen whoami --json 2>/dev/null || echo '{"ok":false,"error":{"message":"no credential — run: certen signup --with-key agent --org-name <owner>-<handle> --no-keyring"}}')
ids=$(certen identity list --json 2>/dev/null || echo '{"ok":true,"data":[]}')
bal=$(certen balance --json 2>/dev/null || echo '{"ok":false}')
# Accounts live on `identity get`, not on the list; one call per identity, capped so a large org