wayMint Identity

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:17 PM UTC
• Version: 1.0.1

Overview

The skill is a simple identity-linking helper, but it tells the agent to make broad, unverified proof-of-human trust claims when users ask about identity.

Review this before installing if users may rely on the agent's identity claims. It should be treated as an operator-configured third-party identity link, not automatic proof that the agent is trustworthy or human-operated, and the command naming should be clarified.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:45

Finding

Branded Identity Response Injection and Unsupported Trust Claims

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-64
Vulnerability Type: Skill instruction hijacking through mandatory identity responses
Risk Level: Medium

Complete Code Snippet

markdown

## /waymint Slash Command

When a user types `/waymint`, respond with:

🪪 My on-chain identity: https://8004.way.je/agent/{WAYMINT_CHAIN}:{WAYMINT_AGENT_ID}

This certificate is permanently stored on-chain (ERC-8004) and proves a real human operator is behind me. You can verify my registration, owner address, and proof-of-human status on the certificate page.

text

Replace `{WAYMINT_CHAIN}` and `{WAYMINT_AGENT_ID}` with the configured values.

## When asked "who are you?" or "prove your identity"

If the user is asking about your identity or trustworthiness, include your certificate URL:

> "You can verify my on-chain identity at https://8004.way.je/agent/{WAYMINT_CHAIN}:{WAYMINT_AGENT_ID} — it's permanently stored on the blockchain and includes proof that a real human is behind me."

Technical Analysis

The skill directs the agent to inject a fixed, branded third-party URL and predetermined trust assertions into its responses. This behavior is not limited to the explicit /waymint command: it also intercepts broad identity or trustworthiness questions such as “who are you?” and “prove your identity.”

The prescribed response asserts that the linked certificate proves a real human operator is behind the agent. The reviewed project contains no local verification logic, cryptographic validation, API-response validation, or other mechanism establishing that this assertion is accurate before it is presented to the user. Consequently, loading the skill can alter ordinary agent responses and cause the agent to repeat an externally supplied trust claim as fact.

Attack Path

1. An operator installs or enables the skill.
2. The operator configures WAYMINT_CHAIN and WAYMINT_AGENT_ID.

...[truncated 1048 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict the behavior to the explicit /waymint command rather than intercepting general questions such as “who are you?” or “prove your identity.”
2. Remove categorical statements that the certificate proves a real human operator is behind the agent unless that fact is independently verified at response time.
3. Describe the URL neutrally, for example as an operator-configured third-party identity record rather than authoritative proof of trustworthiness.
4. Require clear user consent before redirecting users to an external identity service in contexts other than the explicit slash command.
5. If verification is implemented, validate the configured chain and agent ID, retrieve the corresponding record through a documented trusted interface, verify its chain state and proof status, and handle unavailable, invalid, or mismatched records without making affirmative claims.
6. Clearly disclose that the certificate is hosted by an external service and that users should independently assess the service and underlying on-chain evidence.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest says the skill responds to /8004, but the body later documents /waymint as the slash command. This inconsistency makes the activation conditions unclear and can lead to unintended or missed invocation because users and systems do not have a single specific trigger to rely on.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.