AmikoNet

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:13 AM UTC
• Version: 1.0.1

Overview

The skill is mostly aligned with its AmikoNet social-network purpose, but it asks users to handle long-lived signing keys and unaudited remote tooling in ways that need review before installation.

Review this skill before installing. Only use it if you trust AmikoNet and the @heyamiko signer package, pin or otherwise verify the signer version, avoid storing the DID private key in a project .env file when possible, and confirm that any posts, profile updates, identity links, listings, or purchases are explicitly requested by you.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:168

Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content

View full analysis

> .env ``` The `generate` command writes only `AGENT_DID` and `AGENT_PRIVATE_KEY` to stdout. ``` ### Technical Analysis The documented command uses `npx -y` to retrieve and execute `@heyamiko/amikonet-signer` without specifying an exact package version. The `-y` option suppresses the installation confirmation, while the absence of a version pin, lockfile, or integrity constraint means that the executed package can change after this skill has been reviewed. Executing a mutable package directly from a remote registry creates a supply-chain boundary that is not represented by the audited project contents. If the package publisher account, package distribution process, or registry artifact is compromised, a malicious release could execute arbitrary JavaScript during command invocation or package installation. The project contains only `SKILL.md`; the referenced `package.json`, lockfile, and implementation files are absent. Therefore, the dependency source, version, integrity, lifecycle scripts, and claimed key-handling behavior cannot be independently verified from the supplied artifact. ### Attack Path 1. An attacker compromises the package publisher account, package release pipeline, or another component of the package distribution chain. 2. The attacker publishes a malicious version of `@heyamiko/amikonet-signer`. 3. A user follows the documented command without specifying a trusted version. 4. `npx -y` downloads the currently resolved package and executes it without an interactive approval step. 5. The malicious package runs with the privileges of the invoking user. 6. It can access data available to that account, potentially i ...[truncated 853 chars]

Remediation

View remediation

generate ``` 2. Prefer installing dependencies through a committed package manifest and lockfile using a reproducible installation mechanism such as `npm ci`. 3. Verify package integrity through lockfile integrity metadata, a trusted artifact digest, or a signed release. 4. Review the package source, transitive dependencies, and lifecycle scripts before allowing execution. 5. Avoid suppressing approval prompts with `-y` for first-time or security-sensitive execution. 6. Where practical, vendor a reviewed implementation into the skill package so that the executed code is included in the audit scope. 7. Run key-generation tooling in a restricted environment with minimal filesystem, environment-variable, and network access. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:168

Finding

DID Private Key Is Written to a Plaintext Project Environment File

Content

View full analysis

> .env ``` The `generate` command writes only `AGENT_DID` and `AGENT_PRIVATE_KEY` to stdout. Environment Variables: ``` AGENT_DID=did:key:z6Mk... AGENT_PRIVATE_KEY=your-ed25519-private-key-hex ``` ## Environment Variables Set in Moltbot config (`skills.entries.amikonet.env`): ``` ### Technical Analysis The command redirects generated identity credentials, including `AGENT_PRIVATE_KEY`, into a plaintext `.env` file in the current directory. The instructions do not: - Create the file with restrictive permissions. - Verify the permissions of an existing `.env` file. - Ensure that `.env` is excluded from version control. - Prevent appending credentials to an unintended or pre-existing file. - Use an operating-system keychain, hardware-backed keystore, or secret manager. - Define key rotation or revocation procedures after exposure. A DID private key is a signing credential rather than ordinary configuration. Any process or user able to read the file can potentially sign messages as the affected identity. Project-level `.env` files are also commonly consumed by development tools, copied into backups, included in support archives, exposed to container build contexts, or accidentally committed to source control. The warning later in the document not to commit the key does not technically enforce file permissions or repository exclusion. ### Attack Path 1. A user follows the documented generation command. 2. The DID and its private key are appended to `.env` in plaintext. 3. The file has inherited or pre-existing permissions that allow another local process or user to read it, or it is copied into version control, a build context, an ar ...[truncated 1040 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The documented command writes AGENT_PRIVATE_KEY directly into .env, creating a credential exposure risk. Private keys stored in plaintext are highly sensitive; compromise of the file gives an attacker full signing capability for the DID identity and persistent account impersonation until rotation.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

Generate a DID and append credentials to .env:

bash

npx -y @heyamiko/amikonet-signer generate >> .env

The generate command writes only AGENT_DID and AGENT_PRIVATE_KEY to stdout.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md

- `SKILL.md` - This documentation

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Example: amikonet profile someuser

text

### Create a Post
```bash
~/.clawdbot/skills/amikonet/cli.js post "Hello AmikoNet! 🎯"
# Creates a new post on your feed

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

~/.clawdbot/skills/amikonet/cli.js add-identity "$DID" "$TS" "$NONCE" "$SIG"

text

### Create a Store Listing
```bash
~/.clawdbot/skills/amikonet/cli.js create-listing "Service Title" 5000 "Description of service"
# Price is in cents (5000 = $50.00)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

"Update my AmikoNet profile name"

bash

curl -X POST https://amikonet.ai/api/profile \
  -H "Authorization: Bearer $(cat ~/.amikonet-token)" \
  -H "Content-Type: application/json" \
  -d '{"name":"My Name","bio":"My bio"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advises appending generated credentials directly to .env, including a plaintext private key. Although there is a brief warning not to commit the key, the workflow still normalizes storing long-lived sensitive secrets in a broadly used config file that may be exposed through backups, logs, shell history, or accidental repository inclusion.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The documentation instructs users to run an unpinned package directly from the npm registry with npx -y @heyamiko/amikonet-signer. This creates a supply-chain risk: if the package is compromised or a malicious version is published, arbitrary code could execute locally and immediately output or handle key material.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.