Verified Agent Identity

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:34 AM UTC
• Version: 1.0.0

Overview

This identity skill does what it says, but it should be reviewed because it can create and keep agent private keys in local plaintext storage by default.

Install only if you are comfortable with this skill creating and persisting agent identity keys. Configure BILLIONS_NETWORK_MASTER_KMS_KEY before creating or importing an identity, avoid passing valuable existing private keys on the command line, review each DID/challenge/linking request before signing, and prefer pinned install commands or a reviewed package version.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/shared/storage/keys.js:47

Finding

Private keys may be stored in plaintext without enforced owner-only filesystem permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/shared/storage/challenge.js:8

Finding

Authentication challenges can be replayed indefinitely

Content

View full analysis

entry.did === did); if (index >= 0) { // Update existing entry entries[index] = { did, challenge, created_at }; } else { // Add new entry entries.push({ did, challenge, created_at }); } await this.writeFile(entries); } async find(did) { const entries = await this.readFile(); return entries.find((entry) => entry.did === did); } async getChallenge(did) { const entry = await this.find(did); return entry?.challenge; } ``` `scripts/verifySignature.js:18-23, 49-58`: ```js // Get the stored challenge const challenge = await challengeStorage.getChallenge(args.did); if (!challenge) { console.error(`Error: No challenge found for DID: ${args.did}`); console.error("Generate a challenge first with generateChallenge.js"); process.exit(1); } ``` ```js // Verify the challenge matches const payload = basicMessage.body; if (payload.message !== challenge) { console.error( `Error: Invalid signature: challenge mismatch ${payload.message} !== ${challenge}`, ); process.exit(1); } outputSuccess("Signature verified successfully"); ``` ### Technical Analysis The challenge record includes a creation timestamp, but verification retrieves only the challenge value and never checks the timestamp. There is no configured lifetime after which a challenge becomes invalid. After successful signature verification, the challenge is not deleted, marked as ...[truncated 1621 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (48)

Known Vulnerable Dependency: shell-quote==1.8.3 — 2 advisory(ies): CVE-2026-13311 (shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)); CVE-2026-9277 (shell-quote quote() does not escape newlines in object .op values)

Critical

• Category: Supply Chain
• Confidence: 96% confidence

Finding

shell-quote 1.8.3 has advisories for parsing DoS and improper escaping of newlines in object .op values. In an agent skill, the presence of shell-quote is particularly concerning because these systems often transform model or user input into command invocations; improper quoting can turn untrusted input into shell injection or command-manipulation conditions.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: shell-quote==1.8.3 — 2 advisory(ies): CVE-2026-13311 (shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)); CVE-2026-9277 (shell-quote quote() does not escape newlines in object .op values)

Critical

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The project declares shell-quote 1.8.3, which is identified as having known vulnerabilities including quadratic-complexity denial of service and improper escaping of newline characters in object .op values. In an agent skill that may process untrusted identity- or user-supplied input and could plausibly build or parse shell-like arguments, this creates a realistic path to service disruption or unsafe command handling if the library is used.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 114)May include surrounding context.

md

| `identities.json`  | Identity metadata                                                                  |
| `defaultDid.json`  | Active DID and associated public key                                               |
| `challenges.json`  | Per-DID challenge history                                                          |
| `credentials.json` | Verifiable credentials                                                             |

There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as identity verification/linking functionality, but the content shows it also performs local private-key custody and may store key material in plaintext when no master key is configured. That is a material security behavior not clearly surfaced by the high-level description, and it can lead operators or users to invoke the skill without realizing it handles and persists highly sensitive secrets.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

bash

cd scripts && npm inst

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill explicitly documents storage of sensitive identity materials including private keys and verifiable credentials under a predictable local path, with plaintext storage possible when no master key is set. In an agent environment, any overbroad file access, logging, backup, or companion skill could expose these files, enabling identity theft, fraudulent signing, or credential exfiltration.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

- `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

ws 8.18.0 is flagged for uninitialized memory disclosure and memory-exhaustion DoS, both of which are meaningful in a networked agent skill. Since this skill depends on blockchain and identity tooling that commonly uses websocket RPC connections, vulnerable ws versions materially increase remote attack surface.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.1.0 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

brace-expansion 2.1.0 has multiple DoS advisories tied to exponential or unbounded expansion behavior. Even as a transitive dependency, it can become exploitable if any user-controlled glob-like patterns are processed, causing CPU or memory exhaustion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

fast-uri 3.1.0 is reported vulnerable to host confusion and SSRF-related parsing issues. This matters in a decentralized identity skill because DID, JSON-LD, registry, and verifier components may resolve remote URLs; a bad parser can subvert allowlists or redirect server-side fetches.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

ws 7.5.10 is vulnerable to memory exhaustion DoS from crafted fragmented frames or data chunks. If any dependency exposes websocket listeners or clients that process attacker-influenced streams, this can lead to resource exhaustion and service instability.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: underscore==1.13.6 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

underscore 1.13.6 is reported vulnerable to unlimited recursion in functions like _.flatten and _.isEqual, enabling DoS with maliciously nested input. In a skill that may compare or normalize complex identity documents and proofs, attacker-controlled deeply nested objects are realistic enough to matter.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

undici 5.29.0 carries multiple high-severity advisories including request/response smuggling, queue poisoning, and CRLF-related issues. This is especially relevant because identity and JSON-LD tooling often performs server-side fetches to registries, issuers, and verifiers, making HTTP client correctness security-critical.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

ws 8.17.1 is another vulnerable websocket version with both memory disclosure and memory exhaustion issues. Multiple vulnerable ws versions indicate broad exposure across providers and RPC stacks, increasing the probability that at least one reachable network path remains exploitable.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The lockfile contains ws 8.18.0, and the listed advisories indicate both uninitialized memory disclosure and memory-exhaustion denial of service in WebSocket processing. This is especially relevant in an agent identity skill because such systems commonly maintain long-lived network connections and may process untrusted remote inputs, increasing the chance that a malicious peer could leak process memory or degrade availability.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The credential store persists to credentials.json, indicating raw credential data is kept locally. In the context of an agent identity verification skill, credentials may contain attestations or authentication-related material that could be abused for unauthorized access, correlation, or sensitive data disclosure if the host is compromised.

Content

Scanner excerpt · scripts/shared/bootstrap.js (reported line 54)May include surrounding context.

js

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

When no master key is present, _encodeEntry silently falls back to provider "plain" and writes raw private key material to disk. In an agent identity/authentication skill, storing private keys unencrypted creates a direct path to key theft via local file access, backups, logs, or container/image leakage, which can lead to impersonation and irreversible compromise of decentralized identity credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The list() method returns every alias together with its raw private key material, greatly expanding secret exposure beyond the minimal need-to-know access pattern. In this skill's context, these keys are used for agent identity and authentication proofs, so any caller that can invoke listing can extract all identities at once and impersonate agents or forge attestations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to execute remote packages via npx clawhub@latest install ..., which fetches and runs the latest published code at install time rather than a pinned, reviewed version. This creates a supply-chain risk: if the package or a dependency is compromised, users may execute attacker-controlled code simply by following the documented install step.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README tells users to run npx skills add BillionsNetwork/verified-agent-identity without pinning the skills package version, so the command may resolve to whatever version is current at execution time. For an identity-management skill that handles keys and credentials, this increases the chance of supply-chain compromise during installation and makes builds non-reproducible.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This installation instruction again relies on npx clawhub@latest, which executes mutable remote code from the npm registry. Using @latest is especially risky because any future malicious or broken release would be immediately consumed by users following the documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The second npx skills example also omits version pinning, leaving installation dependent on the current state of the registry. Because this skill manages decentralized identities and may create or access private keys, executing an unpinned installer raises meaningful compromise risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README asks users to create identities and even supply existing Ethereum private keys before prominently warning that, unless BILLIONS_NETWORK_MASTER_KMS_KEY is configured, keys may be persisted in plaintext on disk. That ordering and lack of up-front warning can lead users to unknowingly expose highly sensitive key material, especially in shared or poorly secured environments.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares executable behavior requiring environment access and network interaction, but it does not declare an explicit tool/permission scope. In an agent ecosystem, missing scope boundaries can cause the host to expose more capability than users expect, increasing the chance of unintended network calls or access to sensitive environment-backed secrets during identity operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation guidance uses broad natural-language triggers like 'Link your agent identity to me,' which can overlap with ordinary conversation and cause the skill to activate in situations the user did not intend as a privileged identity operation. Because the skill can create identities, sign challenges, and generate verification requests, accidental invocation could result in unauthorized authentication actions or disclosure of identity artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code accepts a raw private key from arguments or generates a new one, then derives a signer from it for identity creation. Although the code has comments for developers, it provides no user-facing confirmation, warning, or disclosure that sensitive credential material is being handled and will be used to create a stored identity.

Content

No source excerpt is available for this finding.