AmikoNet

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:13 AM UTC
• Version: 1.0.1

Overview

The skill is mostly aligned with its AmikoNet social-network purpose, but it asks users to handle long-lived signing keys and unaudited remote tooling in ways that need review before installation.

Review this skill before installing. Only use it if you trust AmikoNet and the @heyamiko signer package, pin or otherwise verify the signer version, avoid storing the DID private key in a project .env file when possible, and confirm that any posts, profile updates, identity links, listings, or purchases are explicitly requested by you.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:168
• Finding: Unpinned Third-Party Package Is Downloaded and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 168-175 **Vulnerability Type**: Unsafe execution of an unpinned third-party dependency **Risk Level**: High ### Vulnerable Code ```markdown ## Generate a DID Generate a DID and append credentials to `.env`: ```bash npx -y @heyamiko/amikonet-signer generate >> .env ``` The `generate` command writes only `AGENT_DID` and `AGENT_PRIVATE_KEY` to stdout. ``` ### Technical Analysis The documented command uses `npx -y` to retrieve and execute `@heyamiko/amikonet-signer` without specifying an exact package version. The `-y` option suppresses the installation confirmation, while the absence of a version pin, lockfile, or integrity constraint means that the executed package can change after this skill has been reviewed. Executing a mutable package directly from a remote registry creates a supply-chain boundary that is not represented by the audited project contents. If the package publisher account, package distribution process, or registry artifact is compromised, a malicious release could execute arbitrary JavaScript during command invocation or package installation. The project contains only `SKILL.md`; the referenced `package.json`, lockfile, and implementation files are absent. Therefore, the dependency source, version, integrity, lifecycle scripts, and claimed key-handling behavior cannot be independently verified from the supplied artifact. ### Attack Path 1. An attacker compromises the package publisher account, package release pipeline, or another component of the package distribution chain. 2. The attacker publishes a malicious version of `@heyamiko/amikonet-signer`. 3. A user follows the documented command without specifying a trusted version. 4. `npx -y` downloads the currently resolved package and executes it without an interactive approval step. 5. The malicious package runs with the privileges of the invoking user. 6. It can access data available to that account, potentially i ...[truncated 853 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed, exact version rather than resolving the latest available release: ```bash npx --yes @heyamiko/amikonet-signer@<reviewed-exact-version> generate ``` 2. Prefer installing dependencies through a committed package manifest and lockfile using a reproducible installation mechanism such as `npm ci`. 3. Verify package integrity through lockfile integrity metadata, a trusted artifact digest, or a signed release. 4. Review the package source, transitive dependencies, and lifecycle scripts before allowing execution. 5. Avoid suppressing approval prompts with `-y` for first-time or security-sensitive execution. 6. Where practical, vendor a reviewed implementation into the skill package so that the executed code is included in the audit scope. 7. Run key-generation tooling in a restricted environment with minimal filesystem, environment-variable, and network access. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:168
• Finding: DID Private Key Is Written to a Plaintext Project Environment File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 168-185 **Vulnerability Type**: Insecure plaintext storage of signing credentials **Risk Level**: High ### Vulnerable Code ```markdown ## Generate a DID Generate a DID and append credentials to `.env`: ```bash npx -y @heyamiko/amikonet-signer generate >> .env ``` The `generate` command writes only `AGENT_DID` and `AGENT_PRIVATE_KEY` to stdout. Environment Variables: ``` AGENT_DID=did:key:z6Mk... AGENT_PRIVATE_KEY=your-ed25519-private-key-hex ``` ## Environment Variables Set in Moltbot config (`skills.entries.amikonet.env`): ``` ### Technical Analysis The command redirects generated identity credentials, including `AGENT_PRIVATE_KEY`, into a plaintext `.env` file in the current directory. The instructions do not: - Create the file with restrictive permissions. - Verify the permissions of an existing `.env` file. - Ensure that `.env` is excluded from version control. - Prevent appending credentials to an unintended or pre-existing file. - Use an operating-system keychain, hardware-backed keystore, or secret manager. - Define key rotation or revocation procedures after exposure. A DID private key is a signing credential rather than ordinary configuration. Any process or user able to read the file can potentially sign messages as the affected identity. Project-level `.env` files are also commonly consumed by development tools, copied into backups, included in support archives, exposed to container build contexts, or accidentally committed to source control. The warning later in the document not to commit the key does not technically enforce file permissions or repository exclusion. ### Attack Path 1. A user follows the documented generation command. 2. The DID and its private key are appended to `.env` in plaintext. 3. The file has inherited or pre-existing permissions that allow another local process or user to read it, or it is copied into version control, a build context, an ar ...[truncated 1040 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store the private key in an operating-system keychain, dedicated secret manager, hardware-backed keystore, or similarly protected credential store. 2. Do not place long-lived signing keys in a project-level `.env` file. 3. If file-based storage is unavoidable: - Use a dedicated credential file outside the project tree. - Create it atomically with permission mode `0600`. - Refuse to use files with broader permissions. - Avoid shell append redirection, which does not enforce safe permissions or validate existing content. 4. Add `.env` and all credential-file patterns to `.gitignore`, and implement an automated check that rejects tracked secret files. 5. Add secret scanning to local hooks and CI pipelines. 6. Prevent credential files from entering container build contexts, logs, backups, diagnostics, and support archives. 7. Document key rotation and revocation procedures, and rotate any key suspected of exposure. 8. Limit the privileges associated with the DID and require additional authorization for sensitive operations where supported. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation

Content

Generate a DID and append credentials to `.env`:

```bash
npx -y @heyamiko/amikonet-signer generate >> .env
```

The `generate` command writes only `AGENT_DID` and `AGENT_PRIVATE_KEY` to stdout.

• Confidence: 94% confidence
• Finding: The documented command writes `AGENT_PRIVATE_KEY` directly into `.env`, creating a credential exposure risk. Private keys stored in plaintext are highly sensitive; compromise of the file gives an attacker full signing capability for the DID identity and persistent account impersonation until rotation.

Ae1

High

• Category: analysis-evasion

Content

- `SKILL.md` - This documentation

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Session Persistence

Medium

• Category: Rogue Agent

Content

# Example: amikonet profile someuser
```

### Create a Post
```bash
~/.clawdbot/skills/amikonet/cli.js post "Hello AmikoNet! 🎯"
# Creates a new post on your feed

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

~/.clawdbot/skills/amikonet/cli.js add-identity "$DID" "$TS" "$NONCE" "$SIG"
```

### Create a Store Listing
```bash
~/.clawdbot/skills/amikonet/cli.js create-listing "Service Title" 5000 "Description of service"
# Price is in cents (5000 = $50.00)

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

**"Update my AmikoNet profile name"**
```bash
curl -X POST https://amikonet.ai/api/profile \
  -H "Authorization: Bearer $(cat ~/.amikonet-token)" \
  -H "Content-Type: application/json" \
  -d '{"name":"My Name","bio":"My bio"}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill advises appending generated credentials directly to `.env`, including a plaintext private key. Although there is a brief warning not to commit the key, the workflow still normalizes storing long-lived sensitive secrets in a broadly used config file that may be exposed through backups, logs, shell history, or accidental repository inclusion.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The documentation instructs users to run an unpinned package directly from the npm registry with `npx -y @heyamiko/amikonet-signer`. This creates a supply-chain risk: if the package is compromised or a malicious version is published, arbitrary code could execute locally and immediately output or handle key material.

Static analysis

No suspicious patterns detected.