ERC8004 Agent

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:35 AM UTC
• Version: 0.0.2

Overview

The skill’s identity workflow is mostly coherent, but it needs review because it can persist login tokens in a public memory file and bundle wallet/on-chain actions into one flow.

Install only if you are comfortable with a skill that performs wallet identity registration and authentication. Before use, keep SIWA session tokens out of MEMORY.md or any shared markdown file, use the keyring proxy with a secret manager or encrypted keystore rather than raw private keys in environment variables where possible, and require an explicit human checkpoint before funded on-chain registration or bundled full-flow commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document explicitly requires the agent to stop after wallet creation and wait for user confirmation of funding before any registration attempt, but it also advertises a single full-flow command that proceeds through registration and sign-in sequentially. In an agentic setting, that contradiction can cause autonomous execution of onchain and network actions without the required human checkpoint, leading to failed transactions, unnecessary spending attempts, or unintended state changes.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly frames MEMORY.md as public-only state, then instructs storing session tokens there. Session tokens are authentication material; if MEMORY.md is exposed to other tools, prompts, repos, logs, or collaborators, an attacker may hijack active sessions without needing the wallet key.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The skill's security model claims the private key never enters the agent process, but later documentation allows alternative flows that load the private key in-process. That contradiction weakens the trust boundary and can lead operators or downstream agents to adopt unsafe key handling, exposing the root identity key to prompt injection, memory inspection, or accidental logging.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The template says the file contains only public identity data, but it also references private-key storage in an OS keychain or encrypted file, which conflicts with the stated architecture of using a separate keyring proxy server. This mismatch can lead operators or future tooling to select or document a local keystore backend, weakening key isolation assumptions and increasing the chance of secrets being handled on the agent host.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The spec's key-management guidance says private keys may be stored in environment variables or other locations under the agent's control, which conflicts with the skill metadata stating keys are only held by a separate keyring proxy and never accessed directly by the agent. In an authentication/identity skill, this inconsistency can lead implementers to bypass the intended isolation boundary and handle raw private keys directly, increasing the risk of key theft or misuse.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The full-flow command bundles wallet creation, registration, authentication, and an authenticated API call into one step, but the surrounding documentation does not prominently warn that this performs multiple state-changing and external network actions. That increases the risk that an agent or operator invokes it as a harmless convenience command without understanding that it can trigger blockchain transactions and server-side effects.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The workflow tells the agent to persist a session token without warning that it is sensitive authentication material. In an agent environment, MEMORY.md is often broadly readable by other tools or surfaced in prompts, making silent token persistence a practical credential leakage risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The example appends the full session token to MEMORY.md, creating a direct bearer-token exposure path. Anyone or any component that can read the memory file may reuse the token to impersonate the agent until expiration.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The template explicitly suggests recording SIWA session tokens in a markdown memory file, even though the file is presented as public identity state. Session tokens are authentication credentials; if they are stored in plaintext in a broadly accessible file, anyone with access to the workspace, logs, sync targets, or version control could reuse them to impersonate the agent until expiration or revocation.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The setup guide includes realistic secret-handling commands for `KEYSTORE_PASSWORD` and `AGENT_PRIVATE_KEY` but does not warn users that shell history, terminal logs, screenshots, or accidentally committed files can expose those values. In a security-focused skill, omission of explicit handling cautions can lead operators to copy real secrets into unsafe environments, causing credential leakage.

Credential Access

High

• Category: Privilege Escalation

Content

**Recommended: Deploy to Railway with one click:**

[![Deploy on Railway](https://railway.com/button.svg)](https://railway.com/deploy/siwa-keyring-proxy?referralCode=ZUrs1W)

Set `KEYRING_PROXY_SECRET` (shared HMAC secret) and either `KEYSTORE_PASSWORD` (for encrypted-file backend) or `AGENT_PRIVATE_KEY` (to use an existing wallet). After deployment, configure your agent with:

• Confidence: 87% confidence
• Finding: This section instructs deployment with sensitive inputs including a shared HMAC secret and optionally a raw private key via environment variable, plus a one-click third-party hosting path. Even though it does not directly leak credentials, encouraging operators to place long-lived secrets and private keys into a hosted environment materially raises the chance of credential compromise through misconfiguration, logs, platform exposure, or weak secret handling.

Credential Access

High

• Category: Privilege Escalation

Content

## Important Notes

- **Private keys are NEVER accessible to you.** All signing is delegated to the keyring proxy over HMAC-authenticated HTTP. This is by design — even if you are compromised, the key cannot be extracted.
- **NEVER call the keyring proxy HTTP endpoints directly.** Always use the SDK functions (`createWallet()`, `signMessage()`, etc. from `@buildersgarden/siwa/keystore`) or the CLI commands listed above. The proxy uses a specific HMAC-SHA256 authentication protocol that the SDK handles internally — hand-crafting HTTP requests to the proxy will fail. If you cannot install the SDK, see the "Fallback: Manual HMAC authentication" section in SKILL.md for the exact protocol specification.
- **MEMORY.md** in `siwa/packages/siwa-testing/` contains your public identity state (address, agentId, registration status). Read it to know your current state.
- **Proxy backend is auto-detected** from `KEYRING_PROXY_URL` — no need to set `KEYSTORE_BACKEND` manually.
- If a command fails with "Cannot find module", run `cd /home/node/.openclaw/workspace/siwa/packages/siwa-testing && pnpm install` first.

• Confidence: 82% confidence
• Finding: The instruction says never call proxy endpoints directly, but then points readers to a fallback manual HMAC authentication specification if the SDK cannot be installed. Providing a manual signing/auth protocol for a secret-protected key service increases the chance that agents or operators will implement direct credentialed calls incorrectly, weakening protections through replay flaws, secret mishandling, or unsafe custom clients.

Credential Access

High

• Category: Privilege Escalation

Content

| `AGENT_PRIVATE_KEY` | Proxy server | Hex-encoded private key (0x...) — use an existing wallet instead of generating one |
| `KEYSTORE_PASSWORD` | Proxy server | Password for the encrypted-file keystore (not needed with `AGENT_PRIVATE_KEY`) |

> **Auto-detection**: When `KEYRING_PROXY_URL` is set, `KEYSTORE_BACKEND` automatically defaults to `proxy` — no need to set it manually. When `AGENT_PRIVATE_KEY` is set on the proxy server, `KEYSTORE_BACKEND` defaults to `env`.
>
> The proxy server stores keys using an AES-encrypted V3 JSON Keystore (scrypt KDF) by default. To use an existing wallet instead, set `AGENT_PRIVATE_KEY` on the proxy server — the key is held in memory at runtime (no encrypted file needed).

• Confidence: 72% confidence
• Finding: The documentation permits configuring AGENT_PRIVATE_KEY in the proxy environment and notes the key is then held in memory at runtime. While acceptable in some controlled deployments, this weakens the otherwise stronger keystore-based model and increases the blast radius of host/process compromise or accidental secret handling mistakes.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.