Verified Agent Identity

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:00 AM UTC
• Version: 0.1.0

Overview

This identity skill is purpose-aligned but asks agents to create, store, import, and use signing keys in ways that can expose or misuse sensitive identity material.

Review before installing. Use this only if you intentionally want the agent to manage a Billions DID and sign identity challenges. Configure `BILLIONS_NETWORK_MASTER_KMS_KEY` before creating identities, avoid importing private keys through command-line arguments, and require explicit confirmation before any signing or human-agent linking action.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:35
• Finding: Private Key Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 35-46 **Vulnerability Type**: Private key disclosure through process arguments and shell history **Risk Level**: High **Vulnerable Code Snippet**: ```markdown **Command**: `node scripts/createNewEthereumIdentity.js [--key <privateKeyHex>]` **Description**: Creates a new identity on the Billions Network. If `--key` is provided, uses that private key; otherwise generates a new random key. The created identity is automatically set as default. **Usage Examples**: ```bash # Generate a new random identity node scripts/createNewEthereumIdentity.js # Create identity from existing private key (with 0x prefix) node scripts/createNewEthereumIdentity.js --key 0x1234567890abcdef... # Create identity from existing private key (without 0x prefix) node scripts/createNewEthereumIdentity.js --key 1234567890abcdef... ``` ``` ### Technical Analysis The documented interface accepts a private cryptographic key directly through the `--key` command-line argument. Command-line arguments are not an appropriate secret transport mechanism because they may be exposed through: - Shell history files. - Process inspection facilities while the command is running. - Process accounting and endpoint-monitoring systems. - Terminal session recordings. - Diagnostic logs and command telemetry. - Agent execution logs that record invoked commands. The examples actively encourage users or agents to place an existing identity key in this exposed channel. Although the artifact does not contain the referenced implementation scripts, the documented invocation itself creates a credible disclosure risk whenever followed. ### Attack Path 1. A user or agent follows the documented example and invokes `createNewEthereumIdentity.js` with a real private key in the `--key` argument. 2. The complete command is retained in shell history, agent logs, process telemetry, or another command ...[truncated 997 chars]
• Remediation: ## Remediation Suggestions - Remove support and documentation for passing private keys through command-line arguments. - Accept imported keys through protected standard input without terminal echo, a dedicated secret manager, or a permission-restricted file descriptor. - If file-based import is unavoidable, require a file owned by the current user with restrictive permissions and securely remove temporary material after import. - Ensure invoked commands, arguments, and secret input are redacted from Agent logs, telemetry, error reports, and terminal recordings. - Add explicit documentation warning users never to place private keys in shell commands, environment variables, chat messages, or logs. - Prefer generating keys inside the encrypted keystore so raw private-key material does not need to cross an external interface. - Invalidate and rotate any key previously supplied through this interface if command history or logs may have retained it.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:148
• Finding: Private Identity Keys May Be Stored in Plaintext## Vulnerability Details **File Location**: `SKILL.md`, lines 148-160 **Vulnerability Type**: Plaintext storage of sensitive cryptographic material **Risk Level**: High **Vulnerable Code Snippet**: ```markdown ## Security **CRITICAL - Data Storage and Protection:** The directory `$HOME/.openclaw/billions` contains all sensitive identity data: - `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext) - `defaultDid.json` - DID identifiers and public keys - `challenges.json` - Authentication challenges history - `credentials.json` - Verifiable credentials - `identities.json` - Identity metadata - `profiles.json` - Profile data ``` ### Technical Analysis The documentation explicitly states that `kms.json` contains private keys in plaintext when `BILLIONS_NETWORK_MASTER_KMS_KEY` is not configured. The project metadata marks this environment variable as optional, so secure encryption is not enforced by the documented configuration. Plaintext private-key storage violates secure secret-storage principles. File permissions may reduce exposure but do not protect the key from every process running as the same user, accidental backups, workspace collection, support bundles, malware operating in the user context, or an attacker who later obtains filesystem access. The same directory also stores credentials, identity metadata, profiles, and challenge history. Compromise of the directory could therefore disclose both signing authority and identity-related context. The referenced scripts are absent from the audited artifact, so the implementation of encryption, file permissions, and key derivation could not be independently verified. This finding is based on the behavior explicitly documented by the Skill. ### Attack Path 1. The Skill is used without setting `BILLIONS_NETWORK_MASTER_KMS_KEY`, which the metadata describes as optional. 2. Identity creat ...[truncated 1138 chars]
• Remediation: ## Remediation Suggestions - Make encrypted key storage mandatory and fail closed if a secure master-key source is unavailable. - Do not classify `BILLIONS_NETWORK_MASTER_KMS_KEY` as optional when private identity keys will be stored. - Retrieve the master key from an operating-system keystore, hardware-backed key service, or dedicated secret manager rather than exposing it in routine command output or logs. - Use authenticated encryption with a unique nonce for each encrypted object and a maintained key-derivation scheme where password-derived keys are supported. - Create `$HOME/.openclaw/billions` with owner-only permissions and create private-key files with restrictive permissions from the outset. - Prevent sensitive files from being included in backups, support archives, source-control repositories, and diagnostic bundles unless those destinations provide equivalent encryption and access controls. - Add startup checks that reject plaintext keystores and provide a secure migration process for existing `kms.json` files. - Document key rotation and revocation procedures for users who previously operated without keystore encryption.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol.
metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } }
homepage: https://billions.network/
---

## When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

### After installing the plugin run the following commands to create an identity and link it to your human DID:

```bash
cd scripts && npm inst

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Credential Access

High

• Category: Privilege Escalation

Content

- `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill encourages creating and managing decentralized identities and keys, but does not place a prominent warning before first use that private key material may be stored locally, potentially in plaintext if the master KMS key environment variable is unset. That omission increases the chance users invoke the skill without understanding the persistence and sensitivity of the generated identity material.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The example invocation uses a broad natural-language trigger (e.g., "Link your agent identity to me") that overlaps with ordinary conversation and can cause an agent to execute identity-linking behavior without a sufficiently explicit, security-conscious confirmation step. In this skill, that behavior can trigger signing operations and creation of identity-linkage artifacts, which raises the risk of unintended authentication or association actions.

Static analysis

No suspicious patterns detected.