UID.LIFE Compute Node

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:33 AM UTC
• Version: 1.4.0

Overview

This skill matches its marketplace purpose, but it can autonomously accept paid work, submit placeholder results, move token balances, and persist identity material with weak controls.

Review this skill carefully before installing. It is intended to act in an external agent marketplace and can persist an identity, send task and chat data to UID.LIFE, create proposals, transfer $SOUL, and run a background worker. Do not enable uid-start or use value-moving commands unless you are comfortable with autonomous contract actions, possible reputation or balance impact, and local plaintext identity storage.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: lib/api.js:27

Finding

Ed25519 Private Key Stored in Plaintext Without Explicit Access Restrictions

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: lib/api.js:38

Finding

Handle-Only Login Provides No Proof of Identity Ownership

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:244

Finding

Autonomous Worker Accepts Every Remote Proposal and Submits a Fabricated Fixed Result

Content

View full analysis

{ console.log("🟢 [UID] Autonomous Worker Module ONLINE."); console.log(" - Listening for contracts..."); while (isRunning) { try { const contracts = await client.getPendingContracts(); if (contracts.length > 0) { console.log(`🔔 [UID] ALERT: Received ${contracts.length} new contract proposal(s)!`); for (const c of contracts) { console.log(` > Accepting Contract #${c.id.slice(0, 8)}...`); console.log(` Task: "${c.task_data?.original_description || 'Unknown'}"`); console.log(` Bid: ${c.bid_price} $SOUL`); if (await client.acceptContract(c.id)) { console.log(` ✅ Contract Accepted. Executing work...`); await client.sendLog(c.id, "INITIALIZING_PROTOCOL... COMPUTE_ALLOCATED."); await new Promise(r => setTimeout(r, 2000)); await client.sendLog(c.id, "ANALYSIS_COMPLETE. SUBMITTING_RESULTS."); await client.completeContract(c.id, "Output: [Data Processed]"); console.log(` 🏁 Contract #${c.id.slice(0, 8)} Fulfilled & Paid.`); } else { console.log(` ❌ Failed to accept contract.`); } } } } catch (e) { console.error("🔴 [UID] Connection Error:", e.message); } await new Promise(r => setTimeout(r, 5000)); } })(); ``` ### Technical Analysis When worker mode is enabled, the implementation fetches all proposed contracts assigned to the active identity and accepts every returned item. It does not validate: - Whether the task ...[truncated 2584 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The worker loop automatically accepts incoming contracts and completes them in the background without a clear upfront warning, per-contract confirmation, or runtime approval. In this skill's marketplace and currency context, that means third parties can trigger actions on the user's identity/account automatically, potentially causing financial commitments, spammed submissions, or reputation damage at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The send-funds command performs a currency transfer immediately after parsing arguments, with no confirmation, recipient normalization/verification, or amount sanity checks. Because this skill directly controls a wallet-like balance, a mistaken command, prompt injection through an upstream agent, or recipient typo could cause irreversible loss of assets.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The contract payment command issues payment immediately with no confirmation or contextual warning, even though payment may be irreversible and tied to an on-platform asset balance. In a skill meant for autonomous agents, this is especially risky because an agent or user can pay the wrong contract, pay prematurely, or be induced by malicious instructions to release funds without review.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · lib/api.js (reported line 92)May include surrounding context.

js

})
        });

        if (!res.ok) throw new Error("Failed to update skills");
        return await res.json();
    }

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

sendFunds initiates a value transfer based only on the in-memory identity handle and caller-supplied recipient/amount, with no local confirmation, transaction signing, secondary authorization, or integrity protection visible in the client. In an agent context where tools may be invoked indirectly or by prompt-driven workflows, this makes unauthorized or unintended fund transfers materially easier.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README promotes autonomous network participation, task acceptance, and delegation to other agents without warning users that prompts, data, or system-derived outputs may be transmitted to external services or third-party agents. In a security-sensitive agent environment, this can cause inadvertent data disclosure, unexpected resource consumption, and execution of externally sourced tasks with insufficient operator awareness.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises and relies on networked commands against a live API endpoint but does not declare any explicit tool scope or permissions boundary. That mismatch can cause users or hosting agents to invoke network-capable behavior without clear consent or policy review, which is especially risky in a financial/identity-management skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The uid-start worker is documented to auto-accept and process contracts, which can create binding commitments or trigger downstream actions without per-task user confirmation. In a decentralized labor and payment context, this increases the chance of unauthorized work acceptance, spam contract capture, or automated engagement with malicious tasks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The uid-send <handle> <amount> command enables direct token transfer to another agent but does not warn users about recipient verification or the irreversible nature of the transfer. In a decentralized identity system, handle confusion, impersonation, or simple mistakes can lead to unrecoverable loss of funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The uid-pay <contract_id> command releases payment for a contract but the skill text gives no warning that this is an irreversible transfer of funds. In a tokenized escrow/payment system, users may mistakenly approve fraudulent, incomplete, or spoofed contracts, resulting in permanent financial loss.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes a compute-node role, but the code also includes agent discovery, hiring, and proposal creation features that let the skill delegate work and act on behalf of the user in the marketplace. This scope expansion is security-relevant because orchestration/delegation behavior can incur cost, data exposure, or workflow actions not implied by the advertised purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest frames the skill primarily as a network/compute-node integration for earning currency, but the implementation also exposes wallet-like fund movement and payment capabilities. This mismatch can cause users or higher-level agent frameworks to grant trust or permissions under incomplete assumptions, increasing the chance of unintended financial actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The autonomous worker claims to accept contracts, execute work, and submit results, but it actually sends canned logs and a fixed placeholder output regardless of task content. In a paid contract marketplace, this is dangerous because it can misrepresent task execution, trigger fraudulent or low-integrity submissions, and expose the user account to disputes, reputation loss, or policy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The client persists the agent's private Ed25519 key material in plaintext inside .identity.json without encryption, access controls, or any user disclosure. If the local filesystem is readable by other users, malware, backups, or logs, an attacker can steal the private key and impersonate the agent, potentially taking over identity-linked actions and transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The client sends task descriptions and bid data to a remote API when creating proposals, but the file contains no user-facing disclosure that potentially sensitive task content is transmitted off-system. Similar undisclosed transmissions also occur in logging/chat and contract completion flows, indicating missing warnings around remote data sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill exposes a token transfer capability (uid-send) and a hiring/payment workflow but does not prominently warn that it can move assets or commit funds. In an autonomous agent setting, financial actions are sensitive because prompt injection, malicious job proposals, or operator misunderstanding could trigger unintended transfers or escrow commitments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly defines an autonomous loop that checks inboxes, accepts jobs, performs work, and submits deliverables without requiring human review or safety gates. In a marketplace context, this can cause the agent to autonomously act on untrusted third-party tasking, leading to execution of risky instructions, data leakage, or harmful downstream actions.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · uid_worker.md (reported line 181)May include surrounding context.

md

def on_created(self, event):
        if event.src_path.endswith('.csv'):
            filename = os.path.basename(event.src_path)
            self.s3.upload_file(event.src_path, self.bucket, filename)
            print(f"Uploaded {filename} to S3")

# ... complete implementation

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency is specified with a caret range (^2.6.7), which permits installation of newer 2.x releases without explicit review. This weakens supply-chain control and reproducibility, and in a skill that integrates with decentralized identity, earnings, and agent hiring, a silently changed HTTP client could affect network security behavior or expose sensitive request metadata.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json

"description": "UID.LIFE Integration Skill",
    "main": "index.js",
    "dependencies": {
        "node-fetch": "^2.6.7"
    }
}

Unverifiable Dependency: node-fetch has 3 known advisory(ies) (CVE-2022-0235 (node-fetch forwards secure headers to untrusted sites); CVE-2022-2596 (node-fetch Inefficient Regular Expression Complexity ); CVE-2020-15168 (The `size` option isn't honored after following a redirect in node-fetch)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The manifest uses node-fetch without pinning an exact version, while the package has multiple known advisories affecting some releases. Because the resolved version is not fixed and no lockfile evidence is provided, the skill may install a vulnerable release, which is especially relevant for a network-facing integration that likely handles outbound requests tied to identity and economic operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.