T09 · Insecure Skill Coding Practices
Error
- Location
scripts/shared/storage/keys.js:44- Finding
Private keys may be stored in plaintext without restrictive filesystem permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Bitbrawlers Agent
Security checks for vulnerabilities and agentic risk
Overview
This identity skill is mostly purpose-aligned, but it handles long-lived private keys and can store them unencrypted on disk unless encryption is configured.
Only install this if you are comfortable with the skill creating or using agent identity private keys. Configure BILLIONS_NETWORK_MASTER_KMS_KEY before creating or importing identities, restrict access to $HOME/.openclaw/billions, avoid reusing imported keys, and treat generated signed tokens and pairing links as sensitive. Review the unexpected agent.json mismatch and dependency posture before using this for important authentication flows.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/verifySignature.js:17- Finding
Signed authentication challenges can be replayed indefinitely
- Content
View full analysis
entry.did === did); if (index >= 0) { // Update existing entry entries[index] = { did, challenge, created_at }; } else { // Add new entry entries.push({ did, challenge, created_at }); } await this.writeFile(entries); } ``` `scripts/shared/storage/challenge.js:33-36` ```js async getChallenge(did) { const entry = await this.find(did); return entry?.challenge; } ``` `scripts/verifySignature.js:17-23` ```js // Get the stored challenge const challenge = await challengeStorage.getChallenge(args.did); if (!challenge) { console.error(`Error: No challenge found for DID: ${args.did}`); console.error("Generate a challenge first with generateChallenge.js"); process.exit(1); } ``` `scripts/verifySignature.js:49-56` ```js // Verify the challenge matches const payload = basicMessage.body; if (payload.message !== challenge) { console.error( `Error: Invalid signature: challenge mismatch ${payload.message} !== ${challenge}`, ); process.exit(1); } ``` ### Technical Analysis Challenge records contain a creation timestamp, but verification retrieves only the challenge value and never ...[truncated 2051 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/shared/storage/crypto.js:27- Finding
Encrypted key storage uses a fast unsalted master-key derivation function
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (49)
Known Vulnerable Dependency: shell-quote==1.8.3 — 2 advisory(ies): CVE-2026-13311 (shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)); CVE-2026-9277 (shell-quote quote() does not escape newlines in object .op values)
Critical
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
shell-quote 1.8.3 has advisories for parsing complexity DoS and improper newline escaping in quote(). This package is especially sensitive in an agent skill because shell-quoting libraries are typically used near command construction, so escaping flaws can turn untrusted input into command injection or argument-splitting conditions if the skill invokes subprocesses.
- Content
Known Vulnerable Dependency: shell-quote==1.8.3 — 2 advisory(ies): CVE-2026-13311 (shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)); CVE-2026-9277 (shell-quote quote() does not escape newlines in object .op values)
Critical
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The package explicitly includes shell-quote 1.8.3, which is reported as having denial-of-service and escaping flaws. Even though package.json alone does not prove the vulnerable functions are exercised, shell-quote is commonly used in command construction/parsing; if attacker-controlled input reaches parse() or quote()-based command generation, this could enable resource exhaustion or malformed shell argument handling. In an identity/authentication skill, availability and integrity matter, so parser or escaping weaknesses are more dangerous than in a low-trust toy project.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `identities.json` | Identity metadata | | `defaultDid.json` | Active DID and associated public key | | `challenges.json` | Per-DID challenge history | | `credentials.json` | Verifiable credentials | There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `identities.json` | Identity metadata | | `defaultDid.json` | Active DID and associated public key | | `challenges.json` | Per-DID challenge history | | `credentials.json` | Verifiable credentials | There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented primarily as an identity-verification utility, but its documented behavior also includes local private-key storage, optional encryption, and direct handling of kms.json on disk. This mismatch is dangerous because operators may approve the skill for verification tasks without realizing it persists and manages long-lived secrets locally, which materially changes the risk profile.
- Content
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/
When to use this Skill
Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.
- When you need to link your agent identity to an owner.
- When you need to sign a challenge.
- When you need to link a human to the agent's DID.
- When you need to verify a signature to confirm identity ownership.
- When you use shared JWT tokens for authentication.
- When you need to create and manage decentralized identities.
After installing the plugin run the following commands to create an identity and link it to your human DID:
bash cd scripts && npm inst
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest claims the skill is 'verified-agent-identity' for decentralized identity verification, but the embedded agent metadata instead identifies an unrelated 'BitBrawlers AI' Web3 automation agent. This mismatch is a strong supply-chain and trust-boundary red flag because users or orchestrators may install the skill expecting identity-proof functionality while actually loading a different agent definition, enabling deceptive capability substitution.
- Content
Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
ws 8.18.0 is present with advisories for uninitialized memory disclosure and memory-exhaustion denial of service. In an agent skill that may maintain websocket connections to chains or RPC services, a vulnerable websocket stack can expose process memory or allow remote service degradation through crafted frames.
- Content
Known Vulnerable Dependency: brace-expansion==2.1.0 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)
High
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
brace-expansion 2.1.0 is flagged for multiple denial-of-service issues related to pathological expansion and memory growth. Although often used indirectly in tooling, any runtime path that accepts attacker-controlled patterns could be abused to exhaust CPU or memory.
- Content
Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
fast-uri 3.1.0 is affected by multiple host-confusion and SSRF-related parsing flaws. This is especially relevant in an identity-verification skill because DID, schema, registry, or proof workflows may fetch remote resources, and malformed URLs could bypass allowlists or redirect backend requests to unintended hosts.
- Content
Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
ws 7.5.10 is affected by a memory-exhaustion DoS issue from fragmented frames and small chunks. If any part of the skill or its transitive RPC stack accepts websocket traffic from untrusted or semi-trusted peers, this can be triggered remotely to degrade availability.
- Content
Known Vulnerable Dependency: underscore==1.13.6 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)
High
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
underscore 1.13.6 has unlimited recursion issues in flatten and isEqual that can lead to denial of service. If dependency code compares or normalizes attacker-controlled nested structures, this can crash or hang the agent process.
- Content
Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
undici 5.29.0 is affected by numerous HTTP parsing and request-handling flaws, including smuggling, queue poisoning, and CRLF-related issues. In a decentralized identity skill that may contact registries, resolvers, or verifiers over HTTP, these bugs materially increase SSRF, cache-poisoning, or cross-request confusion risk.
- Content
Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
ws 8.17.1 is another affected websocket version with memory disclosure and DoS advisories. Having multiple vulnerable ws versions increases the chance that at least one reachable runtime path remains exposed, particularly through blockchain RPC or event-stream integrations.
- Content
Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The lockfile pins ws 8.18.0, which is flagged for uninitialized memory disclosure and memory-exhaustion denial of service. In an agent identity skill, WebSocket-based communication may be exposed to untrusted peers or services, so a vulnerable ws version is materially risky if any reachable WebSocket server/client path exists.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 72% confidence
- Finding
This bootstrap code initializes storage for credentials and identities in predictable local files such as credentials.json and identities.json, which can expose highly sensitive identity artifacts if the host environment is shared, compromised, or backed up insecurely. In an agent identity skill, these files may contain attestations and identifiers that are especially privacy-sensitive, making local plaintext persistence more dangerous than in ordinary application state.
- Content
js function newDataStorage(ethStateStorage) { return { credential: new CredentialStorage( new IdentitiesFileStorage("credentials.json"), ), identity: new IdentityStorage( new IdentitiesFileStorage("identities.json"),
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This storage layer explicitly falls back to provider: "plain" and writes privateKeyHex directly to kms.json whenever no master key is available. That means highly sensitive agent private keys can be persisted unencrypted on disk with no guardrail, refusal, or user-visible warning, which is especially dangerous in an identity/authentication skill where compromise of a key can allow impersonation and fraudulent proof generation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The README instructs users to execute
npx clawhub@latest install ..., which fetches and runs remote code at install time without pinning to an immutable version. If the upstream package or one of its resolution targets is compromised, users or agents could execute attacker-controlled code during installation.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The README recommends
npx skills add ...without a pinned package version, so execution depends on whatever package version is current at runtime. This creates a supply-chain risk because install-time code from a mutable package can change after publication of the README.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The human installation instructions again invoke
npx clawhub@latest, repeating the same mutable-code execution pattern for a broader audience. Because this is an identity-management skill handling keys and credentials, compromise during installation could directly expose sensitive material.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The README tells users to run
npx skills add ...with no pinned version in the human setup path as well. That exposes users to supply-chain compromise through install-time script execution from a mutable package source.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README shows identity creation using new or existing Ethereum private keys before prominently warning that, unless a master KMS key is configured, private keys are stored in plaintext on disk. In an identity/authentication skill, this is especially dangerous because theft of these keys enables impersonation and unauthorized proof generation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill declares executable behavior that uses environment variables and networked identity operations, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, this increases the chance that an orchestrator or user cannot accurately understand or restrict what the skill can access, leading to overbroad execution and unintended exposure of local secrets or outbound requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installation and usage instructions tell users to create identities immediately, but the plaintext private-key risk is only disclosed later in the document. Because kms.json may store private keys unencrypted when BILLIONS_NETWORK_MASTER_KMS_KEY is unset, users may create sensitive identities before understanding that they are placing long-lived credentials on disk in potentially recoverable form.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script persists DID metadata and the associated public key to storage automatically, without any user-facing disclosure, consent step, or indication of where that data is being stored. In an identity-management skill, silent persistence of identity artifacts increases privacy risk and can expose sensitive linkage information if local storage, shared environments, or downstream storage backends are accessible to others.
- Content