Security audit

Verified Agent Identity

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed identity-management skill that handles private keys and signing, so it is not risk-free but its sensitive behavior matches its stated purpose.

Install only if you trust this publisher and want Billions decentralized identity features. Set BILLIONS_NETWORK_MASTER_KMS_KEY before creating or importing identities, avoid using a valuable wallet private key with --key, and require clear human approval before any command signs a challenge or creates a human-agent linking URL.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The helper is explicitly described as creating an in-memory KMS, but it actually backs the key store with KeysFileStorage("kms.json"), causing private key material to be persisted to disk. This mismatch can lead operators and downstream code to assume keys are ephemeral and safe from local disclosure when they are not, increasing the chance of accidental key exposure or improper handling.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The invocation guidance uses broad natural-language prompts such as linking identity or verifying ownership, which are common requests in normal conversation. This can cause the skill to trigger in situations where the user did not intend key-backed identity actions, leading to accidental signing, identity linking, or disclosure of verification artifacts.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The setup instructions tell the user to create an identity and link it before presenting a clear warning that sensitive identity material, including private keys, may be stored locally and may be plaintext if the master KMS key is not set. Users could initialize the skill and generate long-lived credentials without understanding the storage and confidentiality implications.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script directly accepts a raw private key via arguments and uses it to derive a signer, but provides no warning about the sensitivity of CLI-supplied secrets. Passing private keys on the command line is dangerous because they may be exposed through shell history, process listings, logging, or CI job output, leading to wallet compromise and identity takeover.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The identity creation flow sends data through a configured RPC provider and potentially interacts with external revocation/identity infrastructure, but the user is not explicitly warned that metadata and transaction-related information will leave the local environment. In a decentralized identity context, this can leak linkable identity information, wallet addresses, and operational metadata to third-party infrastructure, which is especially sensitive for agent-to-human identity binding.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code sends the full authorization request payload to an external URL shortener service, which unnecessarily exposes sensitive identity-verification metadata to a third party. In this skill's context, the message contains authentication and pairing data for linking a human identity to an agent, so disclosure can leak relationship, verification, and workflow details and create additional privacy and integrity risks if the shortener logs, correlates, or tampers with requests.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Sensitive key material is written to a local file (kms.json) with no indication in this file of encryption, access controls, or explicit disclosure. In an agent skill context, local file persistence can expose signing keys to other local users, processes, backups, logs, or compromised environments, enabling identity theft and unauthorized proof/signature generation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code persists credentials, identities, profiles, DIDs, and challenges to local JSON files without any visible controls around confidentiality, retention, or disclosure. For a decentralized identity skill, this data is highly privacy-sensitive and may contain authentication state or correlatable identity artifacts that could be harvested from disk by local attackers or leaked through backups and shared environments.

Missing User Warnings

High

Confidence: 98% confidence
Finding: If no master key is configured, _encodeEntry falls back to provider: "plain" and writes the private key hex directly to disk. For a component handling decentralized identity and authentication material, plaintext-at-rest storage of private keys creates a high-risk secret exposure path through local compromise, backups, logs, or accidental file sharing.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.