Verified Agent Identity Masud

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:34 AM UTC
• Version: 1.0.0

Overview

This identity skill appears purpose-aligned, but it handles long-lived private keys and authentication proofs with insecure defaults that users should review before installing.

Install only in an environment where you are comfortable storing agent identity keys under $HOME/.openclaw/billions. Configure BILLIONS_NETWORK_MASTER_KMS_KEY before creating or importing identities, avoid passing real private keys on the command line, and treat generated proofs and linking URLs as sensitive. Review the dependency state and the authentication challenge behavior before using this for production trust decisions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/shared/storage/keys.js:50

Finding

Private keys are stored in plaintext by default without enforced filesystem permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/shared/storage/challenge.js:8

Finding

Authentication challenges never expire and remain reusable after successful verification

Content

View full analysis

entry.did === did); if (index >= 0) { // Update existing entry entries[index] = { did, challenge, created_at }; } else { // Add new entry entries.push({ did, challenge, created_at }); } await this.writeFile(entries); } async find(did) { const entries = await this.readFile(); return entries.find((entry) => entry.did === did); } async getChallenge(did) { const entry = await this.find(did); return entry?.challenge; } ``` ```js // scripts/verifySignature.js:18-23, 45-57 const challenge = await challengeStorage.getChallenge(args.did); if (!challenge) { console.error(`Error: No challenge found for DID: ${args.did}`); console.error("Generate a challenge first with generateChallenge.js"); process.exit(1); } if (basicMessage.from !== args.did) { console.error( `Error: Invalid from: expected from ${args.did}, got ${basicMessage.from}`, ); process.exit(1); } const payload = basicMessage.body; if (payload.message !== challenge) { console.error( `Error: Invalid signature: challenge mismatch ${payload.message} !== ${challenge}`, ); process.exit(1); } outputSuccess("Signature verified successfully"); ``` ### Technical Analysis Challenge records include `created_at`, but verification never reads or validates that timestamp. Consequently, a challenge remains valid for an unlimited period. Verification also does not delete or atomically mark the challenge as consumed after a successful signature check. The same signed JWS can therefore be submitted repeatedly until another cha ...[truncated 1425 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generateChallenge.js:17

Finding

Generated authentication challenges contain insufficient entropy

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/verifySignature.js:25

Finding

Signature verification relies on an unvalidated third-party DID resolver response

Content

View full analysis

{ const resp = await fetch( `https://resolver.privado.id/1.0/identifiers/${did}`, ); const didResolutionRes = await resp.json(); return didResolutionRes; }, }; // Create JWS packer and unpack token const jws = new JWSPacker(kms, resolveDIDDocument); const basicMessage = await jws.unpack(byteEncoder.encode(args.token)); ``` ### Technical Analysis The verification path delegates DID document resolution to a hard-coded third-party service and passes the response directly to `JWSPacker`. The code does not check the HTTP status, content type, response schema, resolver metadata, requested-versus-resolved DID equality, or whether returned verification material is anchored to the relevant DID network. The request discloses the DID being verified to `resolver.privado.id`. Contrary to a broad interpretation of the static pre-scan warning, this fetch does not directly transmit the supplied JWS token, private key, or locally stored challenge. The exposed information is the DID and associated request metadata. If the resolver, its infrastructure, DNS/TLS trust chain, or upstream resolution process is compromised, attacker-selected verification material may be returned. Whether this results in acceptance depends on `JWSPacker` validation behavior, but the application performs no independent trust validation. ### Attack Path 1. An attacker compromises or controls the configured resolver, its upstream data, or an equivalent trusted network position. 2. The victim invokes `verifySignature.js` for a target DID. 3. The resolver returns a syntactically valid DID resolution response ...[truncated 1006 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (34)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

md

| `identities.json`  | Identity metadata                                                                  |
| `defaultDid.json`  | Active DID and associated public key                                               |
| `challenges.json`  | Per-DID challenge history                                                          |
| `credentials.json` | Verifiable credentials                                                             |

There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The advertised purpose is identity linking and verification, but the skill also manages raw private key material and persists it locally, including possible plaintext storage when no master key is configured. That behavioral gap can mislead users and orchestrators into invoking a credential-handling skill without understanding it creates, imports, and stores long-lived secrets.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

bash

cd scripts && npm inst

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill mentions that kms.json contains private keys encrypted only if a master key is set, otherwise in plaintext, but this warning is buried in the Security section rather than prominently disclosed up front. Because the skill directly handles authentication identities, understated plaintext-key risk can lead to secret compromise from local filesystem access, backups, logs, or multi-user environments.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The skill explicitly references local storage of verifiable credentials and adjacent key material in a predictable directory, which indicates access to sensitive authentication artifacts. In an agent environment, any skill that can read or manipulate such files creates a substantial credential-exposure risk if invoked improperly or combined with other filesystem-capable tools.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

- `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The lockfile contains ws 8.18.0 with advisories for uninitialized memory disclosure and memory-exhaustion DoS. Because identity/authentication tooling commonly uses websocket-based RPC connections to blockchain or verifier infrastructure, a websocket flaw can expose process memory or allow a remote party to degrade availability of verification services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

Brace-expansion 2.0.2 has multiple algorithmic complexity and expansion-related DoS advisories. This package is usually low-risk when only used in tooling, but if any runtime path accepts attacker-controlled glob-like patterns through transitive consumers, it can cause excessive CPU or memory consumption.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Fast-uri 3.1.0 is affected by multiple host-confusion and SSRF-style parsing issues. In a decentralized identity context, the software may resolve DIDs, schemas, contexts, registries, or remote verifier endpoints, so malformed URI handling can materially increase the risk of SSRF, incorrect trust decisions, or outbound requests to attacker-chosen hosts.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Ws 7.5.10 is vulnerable to memory exhaustion from fragmented frames and tiny chunks, making remote DoS feasible. Because this copy sits under jayson and RPC/websocket-related code, an exposed RPC or streaming interface could be knocked offline by a malicious peer, which is significant for an authentication service.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: underscore==1.13.6 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Underscore 1.13.6 has unlimited recursion in _.flatten and _.isEqual, enabling denial of service with crafted nested structures. If transitive components compare or normalize attacker-supplied identity documents or RPC payloads using these helpers, they can be crashed or tied up with pathological input.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Undici 5.29.0 carries multiple high-severity HTTP parsing and request-smuggling style advisories. This is particularly relevant for identity software that fetches remote contexts, schemas, DID documents, registry data, or verifier endpoints, because malformed upstream/downstream HTTP interactions can enable SSRF, cache poisoning, or trust-boundary bypass.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Ws 8.17.1 is affected by memory disclosure and DoS issues, and websocket transport is common in blockchain and decentralized identity integrations. In this skill's context, compromise of websocket handling can interrupt proof verification flows or leak process memory from a long-lived agent service interacting with remote nodes or verifiers.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The credential wallet stores credentials in a local file named credentials.json, indicating sensitive credential material is persisted in an easily discoverable location. In the context of a decentralized identity skill, these credentials may contain attestations and identity-linked data that can be stolen, copied, or reused for unauthorized access or profiling if the host filesystem is exposed.

Content

Scanner excerpt · scripts/shared/bootstrap.js (reported line 54)May include surrounding context.

js

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code explicitly falls back to storing private keys with provider "plain" when no master key is available, meaning sensitive cryptographic material can be persisted to disk unencrypted. In an agent identity skill, those keys are likely authentication or signing keys, so filesystem access, backups, logs, container snapshots, or accidental disclosure can directly compromise agent identity and enable impersonation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx clawhub@latest install ..., which fetches and executes the latest published package version at runtime rather than a pinned, reviewed version. This creates a supply-chain risk: if the package or one of its delivery paths is compromised, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This installation command again uses npx clawhub@latest, causing execution of the most recent remote package without version pinning. In a security-sensitive identity skill, that expands the attack surface because installation-time compromise could steal keys, credentials, or alter verification flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation explicitly tells users to pass an existing Ethereum private key on the command line, which is a sensitive handling anti-pattern. Command-line secrets can be exposed through shell history, process listings, logs, or screenshots, making accidental credential disclosure likely.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill requires network access and reads environment configuration, but it does not declare an explicit tool scope or allowed-tools boundary. In an agent setting, that weakens containment and makes it easier for the skill to trigger networked identity operations or touch sensitive configuration without clear operator awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The setup instructions tell the operator to create an identity and link it immediately, but they do not prominently warn that this generates and persists sensitive identity material on disk. Missing that warning undermines informed consent and can lead users to create durable credentials in environments that are shared, ephemeral, or insufficiently secured.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The invocation guidance is broad enough to match common identity-related user requests and can cause an agent to perform sensitive signing or identity-linking actions with minimal friction. In practice, this increases the chance of over-triggering the skill for ambiguous prompts, leading to unauthorized proof generation or account-linking workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This script accepts or generates an Ethereum private key, derives identity material from it, and persists the resulting DID metadata without any user-facing warning about key sensitivity, storage implications, or operational risk. In an identity-management skill, silent handling of long-lived private keys increases the chance of accidental disclosure, unsafe invocation in automation, or misuse by operators who do not realize they are creating a production identity tied to a wallet key.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code sends the full authorization request payload to an external URL shortener service, which can expose sensitive verification metadata, scope details, callback information, and correlation data to a third party. In an identity-linking skill, this is especially risky because the off-box service can log, inspect, retain, or tamper with authentication request data without any visible user consent or disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code persists key material and identity-related data to predictable local JSON files such as kms.json, identities.json, credentials.json, and defaultDid.json without any visible encryption, access control, or user warning. For an identity/authentication skill, this is particularly dangerous because compromise of these files can expose private keys, DID state, and credentials, enabling impersonation or unauthorized proof generation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==13.0.0 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The lockfile includes uuid 13.0.0, and the cited advisory affects v3/v5/v6 APIs when a caller provides a custom output buffer without sufficient bounds checks. In an agent identity skill, UUID generation may be used for identifiers or request correlation, so the vulnerable code could be reachable if those APIs are exposed to untrusted input, though the practical impact is typically limited to crash/DoS rather than full compromise.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==9.0.1 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Uuid 9.0.1 is present and is covered by the same missing buffer bounds check issue in v3/v5/v6 APIs. In this package it is transitive, but still a real supply-chain risk if downstream code invokes the affected API patterns with attacker-influenced parameters.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.