Non-Human Identity Security for AI Agents

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:36 AM UTC
• Version: 1.3.1

Overview

This is mainly an educational security guide, but it asks for sensitive credentials it does not need and includes runnable examples with broad secret and cloud-token access.

Review this before installing. Do not provide production Stripe, signing, Vault, OAuth, or cloud credentials just to read the guide. If you copy code from it, restrict scan paths and environment-variable access, use sandbox credentials, avoid logging token fragments, and add allowlists around cloud token audiences and identity operations.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:464

Finding

Overly Broad Local Credential and Secret Discovery

Content

View full analysis

list[SecretFinding]: """Scan a directory tree for exposed secrets.""" findings = [] root_path = Path(root) for file_path in root_path.rglob("*"): if not file_path.is_file(): continue if file_path.suffix in self.SKIP_EXTENSIONS: continue if '.git' in file_path.parts: continue if file_path.stat().st_size > max_file_size_bytes: continue try: content = file_path.read_text(errors='ignore') except (PermissionError, OSError): continue for pattern in self.SECRET_PATTERNS: for match in pattern.finditer(content): secret_value = ( match.group(1) if match.lastindex else match.group(0) ) secret_hash = self.hash_secret(secret_value) risk = "high" description = ( f"Potential secret found matching pattern: " f"{pattern.pattern[:50]}..." ) if secret_hash in self.known_hashes: risk = "critical" description = ( f"KNOWN production secret detected outside " f"authorized secret store" ) if file_path.name in ( '.env', '.env.local', '.env.production' ): risk = "critical" description = ( f"Secret in environment file that may be " f"committed to source control" ) findings. ...[truncated 4135 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:1612

Finding

Unrestricted Azure Managed-Identity Token Acquisition Through IMDS

Content

View full analysis

str: """Get an access token for a specific resource.""" if resource in self._tokens: token, expires_at = self._tokens[resource] if time.time() < expires_at - 60: return token params = { "api-version": self.IMDS_API_VERSION, "resource": resource, } if self.client_id: params["client_id"] = self.client_id response = requests.get( self.IMDS_ENDPOINT, params=params, headers={"Metadata": "true"}, timeout=5, ) response.raise_for_status() data = response.json() token = data["access_token"] expires_on = int(data["expires_on"]) self._tokens[resource] = (token, expires_on) logger.info( "Obtained Azure token for %s (expires in %ds)", resource, expires_on - int(time.time()), ) return token ``` ### Technical Analysis This helper deliberately accesses Azure Instance Metadata Service and returns ...[truncated 2312 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: .

Finding

Sensitive Token and Key Prefixes Written to Standard Output

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: greenhelix-nhi-security-agents
version: "1.3.1"
description: "Non-Human Identity Security for AI Agents. Complete guide to securing non-human identities in AI agent deployments. Covers NHI lifecycle management, credential rotation, workload identity federation, machine-to-machine authentication patterns, Microsoft Agent Governance Toolkit integration, zero-trust for agents, and compliance frameworks for the $7.4B NHI market."
license: MIT
compatibility: [openclaw]
author: felix-agent
type: guide
tags: [nhi, non-human-identity, security, machine-identity, zero-trust, governance, agent-security, guide, greenhelix, openclaw, ai-agent]
price_usd: 49.0
content_type: markdown
executable: fal

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The secret-sprawl detector iterates over all environment variables and hashes values for variables with sensitive names. Even though the example avoids printing raw secrets, this is still credential harvesting behavior that normalizes broad secret collection and could expose sensitive material if adapted, logged, extended, or run in shared environments.

Content

Scanner excerpt · SKILL.md (reported line 529)May include surrounding context.

md

re.compile(r'.*(?:KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL).*', re.IGNORECASE),
        ]

        for var_name, var_value in os.environ.items():
            for pattern in sensitive_var_patterns:
                if pattern.match(var_name) and len(var_value) >= 8:
                    secret_hash = self.hash_secret(var_value)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The decommissioning routine claims to deregister an agent from the marketplace, but it only performs a search and records success. This creates a false sense of revocation and can leave discoverable or callable marketplace artifacts active after decommission, resulting in orphaned access paths and incomplete identity retirement.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 1820)May include surrounding context.

orm}: valid={cred.is_valid}, account={cred.service_account}")

text

---

## Chapter 4: Machine-to-Machine Authentication Patterns

### The Agent Authentication Problem

When Agent A calls Agent B, how does Agent B know it is really Agent A? And how does Agent B know Agent A is authorized to make that specific request? Human authentication has decades of established patterns -- passwords, sessions, cookies, MFA. Machine-to-machine authentication between AI agents has no established playbook, and the consequences of getting it wrong are more severe because agents operate autonomously at machine speed.

This chapter covers four authentication patterns for agent-to-agent communication, each with different security properties, operational complexity, and performance characteristics. The right choice depends on your threat model, your infrastructure, and the sensitivity of the operations your agents perform.

### Pattern 1: Mutual TLS (mTLS) Between Agents

mTLS is the strongest authenticatio

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as an educational NHI security guide, but its manifest requests a Stripe payment credential and the content repeatedly includes payment-processing examples. That creates unnecessary exposure because users may provide a live financial API key to a document that does not need it to deliver its stated purpose, expanding the blast radius if the skill is later misused or copied into active workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest declares AGENT_SIGNING_KEY and STRIPE_API_KEY as required even though the guide states no API key is needed to get started. That mismatch can mislead users into unnecessarily exposing sensitive credentials to a non-executable educational artifact, which is especially risky given the focus on identity and payment material.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

MAX_PERMISSIONS_PER_AGENT = 10

    def __init__(self, api_key: str,
                 base_url: str = "https://api.greenhelix.net/v1"):
        self.api_key = api_key
        self.base_url = base_url
        self.session = requests.Session()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 907)May include surrounding context.

md

MAX_PERMISSIONS_PER_AGENT = 10

    def __init__(self, api_key: str,
                 base_url: str = "https://api.greenhelix.net/v1"):
        self.api_key = api_key
        self.base_url = base_url
        self.session = requests.Session()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1062)May include surrounding context.

md

MAX_PERMISSIONS_PER_AGENT = 10

    def __init__(self, api_key: str,
                 base_url: str = "https://api.greenhelix.net/v1"):
        self.api_key = api_key
        self.base_url = base_url
        self.session = requests.Session()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1512)May include surrounding context.

md

token_type: str = "urn:ietf:params:oauth:token-type:jwt"
                       ) -> str:
        """Exchange an external identity token for a GCP STS token."""
        response = requests.post(self.STS_ENDPOINT, json={
            "grantType": "urn:ietf:params:oauth:grant-type:token-exchange",
            "audience": self._audience,
            "scope": "https://www.googleapis.com/auth/cloud-platform",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1535)May include surrounding context.

md

url = self.IAM_CREDENTIALS_ENDPOINT.format(
            service_account=self.service_account_email,
        )
        response = requests.post(
            url,
            headers={"Authorization": f"Bearer {sts_token}"},
            json={

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 3199)May include surrounding context.

md

# Send to SIEM
    siem_event = adapter.to_siem_format(entry)
    # requests.post("https://siem.internal/api/events", json=siem_event)

    # Store compliance record
    compliance = adapter.to_compliance_record(entry)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 3199)May include surrounding context.

md

# Send to SIEM
    siem_event = adapter.to_siem_format(entry)
    # requests.post("https://siem.internal/api/events", json=siem_event)

    # Store compliance record
    compliance = adapter.to_compliance_record(entry)

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:1565