Verified Agent Nifey

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:55 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-aligned for decentralized identity, but it handles long-lived private keys in ways that can expose them by default.

Install only if you are comfortable with this skill creating persistent identity files outside the workspace. Configure BILLIONS_NETWORK_MASTER_KMS_KEY before creating or importing an identity, avoid passing existing private keys on the command line, restrict permissions on $HOME/.openclaw/billions, and review the network endpoints and dependency lockfile before using it for valuable identities.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/shared/storage/keys.js:44

Finding

Private Keys Are Stored Unencrypted by Default with Unrestricted File Modes

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/createNewEthereumIdentity.js:12

Finding

Private-Key Import Through Command-Line Arguments Exposes Secrets to Process and Shell Telemetry

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/shared/storage/challenge.js:8

Finding

Authentication Challenges Have No Expiration and Remain Reusable After Verification

Content

View full analysis

entry.did === did); if (index >= 0) { // Update existing entry entries[index] = { did, challenge, created_at }; } else { // Add new entry entries.push({ did, challenge, created_at }); } await this.writeFile(entries); } async find(did) { const entries = await this.readFile(); return entries.find((entry) => entry.did === did); } async getChallenge(did) { const entry = await this.find(did); return entry?.challenge; } ``` ```js // scripts/verifySignature.js:18-57 const { kms, challengeStorage } = await getInitializedRuntime(); // Get the stored challenge const challenge = await challengeStorage.getChallenge(args.did); if (!challenge) { console.error(`Error: No challenge found for DID: ${args.did}`); console.error("Generate a challenge first with generateChallenge.js"); process.exit(1); } // Create DID resolver that fetches from remote resolver const resolveDIDDocument = { resolve: async (did) => { const resp = await fetch( `https://resolver.privado.id/1.0/identifiers/${did}`, ); const didResolutionRes = await resp.json(); return didResolutionRes; }, }; // Create JWS packer and unpack signature const jws = new JWSPacker(kms, resolveDIDDocument); const basicMessage = await jws.unpack(byteEncoder.encode(args.signature)); // Verify the sender if (basicMessage.from !== args.did) { console.error( `Err ...[truncated 2167 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (36)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 114)May include surrounding context.

md

| `identities.json`  | Identity metadata                                                                  |
| `defaultDid.json`  | Active DID and associated public key                                               |
| `challenges.json`  | Per-DID challenge history                                                          |
| `credentials.json` | Verifiable credentials                                                             |

There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The public description frames the skill as identity proof generation/verification, but the content also documents local key management, private key storage, optional plaintext-at-rest storage, and filesystem interaction. That mismatch is dangerous because operators may approve or trust the skill for verification tasks without realizing it also handles long-lived credentials and secret material.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

bash

cd scripts && npm inst

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The skill explicitly documents storage of private keys, credentials, and related identity artifacts under a predictable directory, with private keys potentially stored in plaintext when the master key is absent. In an agent environment, predictable sensitive-storage paths materially raise the risk of credential theft by other tools, plugins, users, or malware with local access.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

- `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

ws 8.18.0 is flagged for memory disclosure and memory exhaustion issues in WebSocket handling. In an agent skill that may communicate with wallets, chains, or remote verifiers over network channels, a vulnerable WebSocket implementation can expose sensitive process memory or allow denial of service via crafted frames.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

brace-expansion 2.0.2 is associated with multiple denial-of-service conditions from pathological expansion input. If any package path exposes globbing or pattern parsing to untrusted input, an attacker may trigger excessive CPU or memory consumption and disrupt the agent process.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

fast-uri 3.1.0 is flagged for multiple URL parsing and host confusion issues, including potential SSRF-related behaviors. In a decentralized identity skill that may resolve DIDs, fetch schemas, registries, or verifier endpoints, incorrect URI normalization can materially increase risk by allowing requests to unintended hosts or bypassing host-based protections.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

ws 7.5.10 is vulnerable to memory exhaustion DoS from fragmented/data-chunk handling. Because this older ws is pulled in by RPC-related tooling, a malicious peer or server could potentially degrade availability of the agent during blockchain or remote procedure interactions.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: underscore==1.13.6 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

underscore 1.13.6 is flagged for uncontrolled recursion in functions like _.flatten and _.isEqual, leading to potential denial of service on crafted input. If any transitive code compares or flattens attacker-controlled structures, this can crash the process or consume excessive stack/CPU.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

undici 5.29.0 is flagged for multiple high-severity HTTP parsing and request/response handling issues, including smuggling and queue poisoning classes. This is especially relevant for an identity-verification skill because it likely performs outbound HTTP(S) requests to fetch DID documents, registries, attestations, or proofs, making network-layer confusion and SSRF-like impacts more dangerous.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

ws 8.17.1 is affected by memory disclosure and memory exhaustion issues similar to other vulnerable ws entries in this lockfile. Multiple vulnerable ws versions increase the attack surface for denial of service or possible sensitive memory exposure in any component using WebSocket transport.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

This bootstrap code initializes credential storage backed by a local file (credentials.json), and the same module also persists identities, DIDs, challenges, and KMS-backed keys. In an agent identity system, these artifacts can contain sensitive credentials, identity metadata, and authentication material; if stored unencrypted or with weak permissions, local compromise, other processes, or accidental leakage could expose or tamper with identity state.

Content

Scanner excerpt · scripts/shared/bootstrap.js (reported line 54)May include surrounding context.

js

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code explicitly falls back to storing private keys with provider: "plain" when no master key is available, meaning secret key material is written to disk unencrypted. For an identity/authentication skill, local file compromise, backups, logs, or accidental file sharing could directly expose agent private keys and enable impersonation or unauthorized proof generation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to execute remote packages via npx clawhub@latest install ..., which fetches whatever the latest published version is at execution time. This creates a supply-chain risk: a compromised publisher account, malicious update, or dependency hijack could lead users or agents to run attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The documented npx skills add ... flow invokes an unpinned remote package, so the code executed depends on the current registry state rather than a reviewed version. In an identity-management skill that handles keys and credentials, installer compromise could directly expose secrets or install backdoored skill content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This human-facing installation command again uses npx clawhub@latest, causing users to run whatever code is current in the registry at install time. Because this skill is centered on decentralized identity and key material, any installation-time compromise has an elevated chance of leading to credential theft or malicious persistence.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx skills add ... without pinning the package version, which is a classic supply-chain exposure. An attacker controlling the package, one of its dependencies, or a transient registry resolution path could execute arbitrary code on the user's system during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly supports passing an existing Ethereum private key on the command line and states that keys are stored unencrypted when BILLIONS_NETWORK_MASTER_KMS_KEY is not set. Command-line secrets can leak through shell history, process listings, logs, or agent transcripts, and plaintext-at-rest storage compounds the exposure for highly sensitive identity keys.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares execution requirements and clearly performs operations that touch environment variables, local sensitive storage, and network-backed identity/attestation systems, but it does not declare an explicit tool/permission scope. In an agent setting, missing scope boundaries increases the chance that the skill is invoked with broader capabilities than users expect, especially around access to secrets and outbound actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Passing a raw private key as a command-line argument is unsafe because command lines are often exposed via shell history, process listings, audit logs, CI logs, and agent telemetry. This can directly leak the private key, allowing full compromise of the DID identity and any signatures or attestations derived from it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code accepts a raw private key from arguments or generates one locally, then immediately uses it as seed material for identity creation. Although the code has comments and error logs, there is no user-facing disclosure or warning that highly sensitive key material is being handled, which is a safety-relevant credential operation for a code file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code initializes persistent file storage for sensitive wallet-related data using local JSON files, including KMS material and identity artifacts. While the behavior may be functional, there is no confirmation prompt, user-facing log, or explicit warning in this file that such sensitive data will be written to disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The code persists identity metadata by calling the storage layer, but there is no visible user disclosure before or during the write explaining that data will be stored. For code-file warning checks, file/storage writes that affect user data should have some form of confirmation, visible log, or documentation unless already clearly disclosed elsewhere.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==13.0.0 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 85% confidence

Finding

The lockfile includes uuid 13.0.0, which is flagged for a buffer bounds check issue in v3/v5/v6 when a caller supplies a buf argument. This is a real supply-chain risk, although it is typically only reachable if application code or a dependency uses the affected APIs with attacker-influenced parameters, so the practical impact here is limited from the lockfile evidence alone.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==9.0.1 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

uuid 9.0.1 is also present and affected by the same missing bounds check issue. This is a genuine vulnerable dependency, though the exploitability depends on whether vulnerable UUID generation modes are invoked with attacker-controlled buffer arguments.

Content

No source excerpt is available for this finding.