My Verified Agent

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:35 AM UTC
• Version: 1.0.0

Overview

This identity skill is mostly purpose-aligned, but it can store long-lived private keys in plaintext by default, so users should review it carefully before installing.

Install only if you are comfortable with an agent creating or importing identity private keys. Set BILLIONS_NETWORK_MASTER_KMS_KEY before creating identities, restrict permissions on $HOME/.openclaw/billions, avoid importing valuable Ethereum keys, treat signed tokens as reusable until challenges are rotated, and prefer pinned installs plus updated dependencies.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/shared/storage/keys.js:44

Finding

Private keys are stored in plaintext by default without enforced owner-only file permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/verifySignature.js:18

Finding

Signed authentication challenges can be replayed because they do not expire or get consumed

Content

View full analysis

{ const resp = await fetch( `https://resolver.privado.id/1.0/identifiers/${did}`, ); const didResolutionRes = await resp.json(); return didResolutionRes; }, }; // Create JWS packer and unpack token const jws = new JWSPacker(kms, resolveDIDDocument); const basicMessage = await jws.unpack(byteEncoder.encode(args.token)); // Verify the sender if (basicMessage.from !== args.did) { console.error( `Error: Invalid from: expected from ${args.did}, got ${basicMessage.from}`, ); process.exit(1); } // Verify the challenge matches const payload = basicMessage.body; if (payload.message !== challenge) { console.error( `Error: Invalid signature: challenge mismatch ${payload.message} !== ${challenge}`, ); process.exit(1); } outputSuccess("Signature verified successfully"); ``` `scripts/shared/storage/challenge.js:9-22` ```js async save(did, challenge) { const entries = await this.readFile(); const created_at = new Date(); const index = entries.findIndex((entry) => entry.did === did); if (index >= 0) { // Update existing entry entries[index] = { did, challenge, created_at }; } else { ...[truncated 2207 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

md

| `identities.json`  | Identity metadata                                                                  |
| `defaultDid.json`  | Active DID and associated public key                                               |
| `challenges.json`  | Per-DID challenge history                                                          |
| `credentials.json` | Verifiable credentials                                                             |

There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

| `identities.json`  | Identity metadata                                                                  |
| `defaultDid.json`  | Active DID and associated public key                                               |
| `challenges.json`  | Per-DID challenge history                                                          |
| `credentials.json` | Verifiable credentials                                                             |

There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as identity verification/linking functionality, but the documented behavior also includes local private-key storage, optional encryption/decryption, and key record management. That mismatch is dangerous because users or agents may invoke the skill without realizing it handles long-term secret material, increasing the risk of credential exposure, unsafe automation, and inappropriate trust assumptions.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

bash

cd scripts && npm inst

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

ws 8.18.0 is identified with memory disclosure and memory exhaustion DoS advisories. Because this skill depends on blockchain, DID, and RPC/websocket-heavy libraries, vulnerable websocket handling is more relevant than in a purely offline package and could expose process memory or enable denial of service when handling untrusted websocket peers.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

brace-expansion 2.0.2 has multiple DoS advisories related to pathological expansion behavior. This is a true vulnerable dependency, but its practical security impact here is moderated because it is typically exercised in tooling or parsing contexts rather than directly exposed as a network service primitive.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

fast-uri 3.1.0 is associated with multiple host-confusion and SSRF-related advisories. In an identity-verification skill that may resolve DIDs, fetch JSON-LD contexts, or interact with remote registries, URI parsing flaws are particularly relevant because attacker-controlled identifiers or documents may influence outbound requests.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

ws 7.5.10 is flagged for a memory exhaustion DoS issue. Since this package appears through JSON-RPC/websocket-related dependencies, a remote party may be able to consume excessive resources via crafted fragmented websocket traffic if those features are exposed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: underscore==1.13.6 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

underscore 1.13.6 is reported vulnerable to unlimited recursion in _.flatten and _.isEqual, enabling potential DoS on maliciously nested inputs. This is credible, though practical exposure depends on whether untrusted data reaches those utility calls through transitive libraries.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

undici 5.29.0 carries numerous HTTP parsing, smuggling, queue-poisoning, and injection advisories. This is especially concerning in a decentralized identity skill that likely performs outbound HTTP fetches for DIDs, attestations, or JSON-LD resources, because malformed upstream or attacker-directed endpoints could abuse client behavior.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

ws 8.17.1 is vulnerable to both memory disclosure and memory exhaustion DoS. Given the dependency stack includes several networking and RPC components, retaining multiple vulnerable ws versions increases the attack surface if any websocket endpoints or clients interact with untrusted peers.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

This bootstrap code stores credential, identity, DID, challenge, and key-related data in predictable local JSON files, which can expose sensitive identity artifacts if the host is multi-user, backups are accessible, or the files are read by other processes. In an agent identity skill, these files may contain credentials and proof-related data that enable impersonation, privacy loss, or unauthorized reuse if not strongly protected.

Content

Scanner excerpt · scripts/shared/bootstrap.js (reported line 54)May include surrounding context.

js

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

When no master key is available, the storage layer silently falls back to provider="plain" and writes the private key directly to disk in JSON. For an identity/authentication skill handling agent private keys, this creates a serious confidentiality risk because any local user, backup system, log collector, container escape, or filesystem compromise can recover long-lived credentials and impersonate the agent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to execute npx clawhub@latest install verified-agent-identity, which pulls and runs the latest published package version at install time rather than a pinned, reviewed release. This creates a supply-chain risk: if the package or a dependency is compromised, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This is the same supply-chain issue repeated in the Human CTA section: npx clawhub@latest install verified-agent-identity causes execution of an unpinned remote package. Because this skill manages identities and keys, compromise of the install path is especially sensitive and could lead to theft of credentials or malicious modification of the agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation states that private keys are stored in kms.json and explains optional encryption, but normalizes plaintext storage when BILLIONS_NETWORK_MASTER_KMS_KEY is not set. For an identity-management skill, failing to prominently warn that keys may be stored unencrypted by default can lead operators to unintentionally leave highly sensitive secrets recoverable from disk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill requires Node execution, optional access to an environment-held master key, and interaction with external identity infrastructure, yet it declares no explicit tool scope or allowed-tools boundary. In an agent setting, missing capability scoping increases the chance of over-broad execution and unintended access to env/network resources during identity operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions tell users to create identities and store identity material under $HOME/.openclaw/billions, while later admitting kms.json may contain plaintext private keys if BILLIONS_NETWORK_MASTER_KMS_KEY is not set. Encouraging key creation without an upfront warning about plaintext secret storage can directly lead to private-key compromise on multi-user or poorly secured systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code accepts a user-supplied private key and derives a signer from it, but there is no confirmation prompt, warning message, or explanatory comment indicating that sensitive credential material is being consumed. Because handling private keys is safety-critical, the absence of any user disclosure increases the risk of accidental misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code sends the full authorization request object to an external URL shortener without any explicit user-facing disclosure or consent. In this identity-linking context, the payload can contain sensitive metadata such as verifier information, callback data, scope details, and proof request parameters, which may leak relationship, workflow, or identity context to a third party and create privacy and trust risks if the shortener logs, inspects, or is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The code initializes a file-backed key store with "kms.json", which causes sensitive key material to be written to disk. While there are docstrings describing the component, there is no user-facing warning, confirmation, or explicit disclosure here that cryptographic keys and related wallet state will persist locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The importKey path persists supplied secret key material to disk by calling writeFile(), and because writeFile may encode entries as plaintext when no master key is configured, key import can silently create an unencrypted at-rest secret. In this skill's context of decentralized identity and authentication proofs, imported keys are highly sensitive because compromise enables fraudulent attestations or identity impersonation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==13.0.0 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The lockfile includes uuid 13.0.0, which is flagged for a buffer bounds-check issue in v3/v5/v6 when a caller supplies a buf argument. This is a real supply-chain risk, but its exploitability depends on the application actually invoking the affected APIs with attacker-influenced buffer handling; in a dependency lockfile alone, there is no evidence of active exploitation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==9.0.1 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

uuid 9.0.1 is also covered by the same bounds-check advisory affecting certain namespace-based UUID generation paths. This is a genuine dependency weakness, though typically lower severity unless the application passes attacker-controlled buffers into those APIs.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ajv==8.17.1 — 1 advisory(ies): CVE-2025-69873 (ajv has ReDoS when using `$data` option)

Low

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ajv 8.17.1 is reported vulnerable to ReDoS when the $data option is used. This is a real issue, but exploitability depends on whether this package or its consumers validate attacker-controlled schemas/data with $data enabled; the lockfile alone cannot confirm active exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.