Archon Keymaster

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:20 AM UTC
• Version: 0.1.4

Overview

The skill is a coherent DID toolkit, but it needs review because it handles wallet secrets while using unsafe remote/dependency execution patterns and plaintext private-key handling.

Review before installing. Use a test wallet first, avoid running the documented curl | sh command, install and pin dependencies separately before loading ARCHON_PASSPHRASE, and treat any mnemonic or nsec output as highly sensitive because logs or agent transcripts may capture it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:359

Finding

Mutable Remote Installer Is Piped Directly into a Shell

Content

View full analysis

Remediation

View remediation

/install.sh" printf '%s %s\n' '' 'nak-install.sh' | sha256sum --check - less nak-install.sh sh nak-install.sh ``` ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/nostr/derive-nostr.sh:10

Finding

Unpinned npm and npx Dependencies Execute in a Secret-Bearing Environment

Content

View full analysis

/dev/null) if [ -z "$MNEMONIC" ]; then echo "Error: Could not get mnemonic. Is ARCHON_PASSPHRASE set?" >&2 exit 1 fi # Install dependencies if needed if [ ! -f "$DEPS_DIR/node_modules/bip39/package.json" ]; then echo "Installing dependencies..." >&2 mkdir -p "$DEPS_DIR" cd "$DEPS_DIR" npm install --silent bip39 @scure/bip32 secp256k1 bech32 >/dev/null 2>&1 cd - >/dev/null fi ``` Representative sensitive wallet invocations: ```bash WALLET_OUTPUT=$(npx @didcid/keymaster create-wallet 2>&1) echo "$WALLET_OUTPUT" # Display mnemonic explicitly (CLI no longer prints it during create-wallet) npx @didcid/keymaster show-mnemonic | tr -d '\r' read -p "Name for your DID (e.g., 'main', 'work'): " DID_NAME DID_NAME="${DID_NAME:-main}" echo "" echo "Creating DID '$DID_NAME'..." npx @didcid/keymaster create-id "$DID_NAME" ``` ### Technical Analysis The project does not include a package manifest or lockfile pinning the versions and integrity hashes of `@didcid/keymaster`, `bip39`, `@scure/bip32`, `secp256k1`, and `bech32`. The Nostr script invokes `npm install` without versions. npm installation may execute package lifecycle scripts. Bare `npx @didcid/keymaster` may retrieve and execute the current registry version when the package is not already installed locally. These operations inherit the caller’s environment, which is expected to contain `ARCHON_PASSPHRASE` and `ARCHON_WALLET_PATH`. Because package resolution is mutable, a compromised maintainer account, registry entry, transitive dependency, or newly published malicious ...[truncated 1392 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/nostr/derive-nostr.sh:29

Finding

Nostr Derivation Prints a Private Key and Encourages Plaintext Storage

Content

View full analysis

~/.clawstr/secret.key chmod 600 ~/.clawstr/secret.key ``` ### Technical Analysis The script obtains the wallet’s master mnemonic, embeds it into generated JavaScript, derives a private key, and prints the resulting `nsec` directly to standard output. Standard output may be retained by agent transcripts, terminal logging, CI logs, shell wrappers, monitoring systems, or redirected files. The documentation recommends storing the private key as plaintext. It applies `chmod 600` only after creating the file, so the file’s initial permissions depend on the caller’s `umask`. On a permissive configuration, another local user could potentially read the key during the interva ...[truncated 1612 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/crypto/verify-file.sh:36

Finding

Predictable Temporary Files Allow Symlink-Based File Overwrite

Content

View full analysis

&1 | tee /tmp/verify-output.txt; then echo "" echo "✓ Signature valid" # Try to extract signer info from file if command -v jq >/dev/null 2>&1; then SIGNER=$(jq -r '.proof.verificationMethod // .issuer // "unknown"' "$FILE" 2>/dev/null) CREATED=$(jq -r '.proof.created // "unknown"' "$FILE" 2>/dev/null) if [ "$SIGNER" != "unknown" ]; then echo "Signed by: $SIGNER" fi if [ "$CREATED" != "unknown" ]; then echo "Signed at: $CREATED" fi fi else echo "" echo "✗ Signature verification FAILED" echo "" echo "This file may have been tampered with, or the signature is invalid." exit 1 fi rm -f /tmp/verify-output.txt ``` From `scripts/crypto/sign-file.sh`: ```bash # Create temp file for safety TEMP_FILE="${FILE}.signing.tmp" # Sign file (outputs to stdout) if npx @didcid/keymaster sign-file "$FILE" > "$TEMP_FILE" 2>&1; then # Replace original with signed version mv "$TEMP_FILE" "$FILE" echo "✓ File signed (signature added in place)" echo "" echo "Others can verify with:" echo " ./verify-file.sh $FILE" else echo "✗ Signing failed" rm -f "$TEMP_FILE" exit 1 fi ``` ### Technical Analysis `verify-file.sh` writes to the globally predictable path `/tmp/verify-output.txt`. Shell redirection through `tee` follows symbolic links. A local attacker can create that path as a symlink to a file writable by the victim, causing the target to be truncated and replaced with verification output. The temporary output is not subsequently rea ...[truncated 2068 chars]

Remediation

View remediation

&1; then ... fi ``` 2. If temporary output must be retained, create it securely: ```bash umask 077 TMPFILE=$(mktemp "${TMPDIR:-/tmp}/archon-verify.XXXXXX") trap 'rm -f -- "$TMPFILE"' EXIT HUP INT TERM ``` 3. For signing, create the temporary file with `mktemp` in the same directory as the destination so final replacement remains atomic. 4. Check that the temporary path is a regular file and was created exclusively by the current process. 5. Do not follow symbolic links; use platform facilities supporting `O_NOFOLLOW` and exclusive creation where available. 6. Validate that signing output is valid JSON and contains the expected signature before replacing the original. 7. Preserve appropriate ownership and permissions when replacing the original file. 8. Quote cleanup variables safely and install cleanup traps immediately after temporary-file creation. 9. Consider retaining a backup or requiring explicit consent before destructive in-place replacement. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (184)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 107)May include surrounding context.

md

**Credential Systems:**
- Proof of humanity (verified by trusted sources)
- Skill certifications
- Access tokens
- Age verification (prove >18 without revealing exact age)

## How It Works

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code chunk's primary function is transferring an asset from one DID to another using transfer-asset. That capability is not represented in the declared description, which focuses on identity management, credentials, messaging, Nostr, file crypto, aliases, authorization, groups, and polls. While the script operates in the broader Archon/DID ecosystem, asset transfer is a distinct undeclared capability and materially different from the listed functions. The environment loading is incidental support logic, not the mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code chunk is narrowly focused on updating an asset's image by taking an asset DID and a local image file, validating environment configuration, and calling a keymaster command. The declared description lists many DID-related capabilities, but does not mention asset management or updating asset images. While this may be adjacent to identity/DID tooling, the specific primary purpose of this script is materially different from the explicitly declared features, so this is best classified as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied code chunk has a narrow purpose: updating an asset record by DID using JSON input, relying on Archon wallet environment variables. The declared description covers many DID-related functions, but it does not mention asset creation or asset updating. Since this code exposes a specific capability—asset management/update—that is not represented in the declared purpose, this is a description-behavior mismatch. The environment loading is only supportive and not itself a mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

./scripts/schemas/create-schema.sh <schema-file.json>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

./scripts/schemas/create-schema.sh <schema-file.json>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

md

./scripts/schemas/create-schema.sh <schema-file.json>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md

./scripts/schemas/list-schemas.sh

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md

./scripts/schemas/get-schema.sh <schema-did-or-alias>

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

curl ... | sh chains network retrieval directly into shell execution, eliminating any inspection step and enabling instant arbitrary code execution from a mutable remote source. In this skill's context, that code may then access wallet files, passphrases, and other cryptographic key material, making the blast radius severe.

Content

Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.

Install nak CLI:

bash

curl -sSL https://raw.githubusercontent.com/fiatjaf/nak/master/install.sh | sh

Derive Nostr Keys

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 781)May include surrounding context.

md

./scripts/polls/vote-poll.sh <poll-did> <vote-index>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 797)May include surrounding context.

md

./scripts/polls/vote-poll.sh <poll-did> <vote-index>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 801)May include surrounding context.

md

./scripts/polls/vote-poll.sh <poll-did> <vote-index>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 810)May include surrounding context.

md

./scripts/polls/vote-poll.sh <poll-did> <vote-index>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 890)May include surrounding context.

md

./scripts/polls/vote-poll.sh <poll-did> <vote-index>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 891)May include surrounding context.

md

./scripts/polls/vote-poll.sh <poll-did> <vote-index>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 892)May include surrounding context.

md

./scripts/polls/vote-poll.sh <poll-did> <vote-index>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 793)May include surrounding context.

md

./scripts/polls/view-poll.sh did:cid:bagaaiera...

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 833)May include surrounding context.

md

./scripts/polls/view-poll.sh did:cid:bagaaiera...

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 895)May include surrounding context.

md

./scripts/polls/view-poll.sh did:cid:bagaaiera...

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 811)May include surrounding context.

md

./scripts/polls/send-ballot.sh "$BALLOT" "$POLL"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 814)May include surrounding context.

md

./scripts/polls/update-poll.sh "$BALLOT"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 817)May include surrounding context.

md

./scripts/polls/view-ballot.sh "$BALLOT"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 825)May include surrounding context.

md

./scripts/polls/send-poll.sh <poll-did>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 887)May include surrounding context.

md

./scripts/polls/send-poll.sh <poll-did>

Static analysis

No suspicious patterns detected.