Security audit

AliasKit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real identity, inbox, messaging, 2FA, and payment helper, but it stores and exposes sensitive credentials too broadly and lacks clear approval gates for high-impact actions.

Review this carefully before installing. Use it only if you intend an agent to handle real identity, inbox, SMS, 2FA, messaging, and payment workflows; rotate any exposed AliasKit key, restrict identity.json permissions, avoid running setup with untrusted identity IDs, and require explicit approval before purchases, card reveal, outbound messages, deletions, or 2FA use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: scripts/setup.sh:32
Finding: Unpinned Runtime Dependency Installation
Content: View full analysis
/dev/null || npm install aliaskit@latest 2>/dev/null ``` ### Technical Analysis The setup script installs `aliaskit@latest` every time setup runs. No exact version, lockfile, or integrity hash constrains the downloaded package. npm installation can also execute package lifecycle scripts. The dependency is subsequently trusted with the AliasKit API key and processes identity information, email, SMS, TOTP data, card-encryption material, and potentially payment-card information. Consequently, a compromised package release, maintainer account, npm distribution channel, or transitive dependency could execute arbitrary code in the context of the user running setup. The network installation is related to the Skill's declared functionality, but automatically downloading the mutable latest release exceeds the minimum safe privilege necessary. A fixed, reviewed SDK version would provide the same functionality with a substantially narrower supply-chain trust boundary. ### Attack Path 1. An attacker compromises the `aliaskit` npm package, one of its dependencies, or its publishing account. 2. The attacker publishes a malicious version that becomes the package tagged as `latest`. 3. A user runs `scripts/setup.sh`. 4. npm downloads the malicious package and may execute its lifecycle scripts immediately. 5. The malicious code runs with the privileges of the user executing setup. 6. It can access local files and environment variables, including `ALIASKIT_API_KEY`. 7. During later SDK operations, it may also access the identity ID, inbox contents, card key, TOTP secrets, and payment information. ### Impact Assessment Successful exploitation pro ...[truncated 445 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.sh:44
Finding: JavaScript Injection Through the Existing Identity ID
Content: View full analysis
/dev/null || EXISTING_ID="" if [ -n "$EXISTING_ID" ]; then # Fetch existing identity echo "Fetching identity $EXISTING_ID..." node -e " const { AliasKit, generateCardKey } = require('aliaskit'); (async () => { try { const ak = new AliasKit(); const identity = await ak.identities.get('$EXISTING_ID'); ``` ### Technical Analysis `EXISTING_ID` is interactive, untrusted input. The script inserts it directly into a single-quoted JavaScript string inside a program supplied to `node -e`. Shell quoting around the overall program does not make the generated JavaScript safe. An identity value containing a single quote can terminate the JavaScript string and inject additional JavaScript statements. Node.js code has access to the filesystem, environment variables, subprocess APIs, and network APIs. No validation restricts the input to the expected identity-ID syntax, and no safe argument-passing mechanism separates the data from the executable JavaScript source. ### Attack Path 1. An attacker convinces a user or automated agent to provide a crafted existing identity ID. 2. The supplied value contains JavaScript syntax that terminates the string argument to `ak.identities.get`. 3. The value appends attacker-controlled JavaScript and comments out or otherwise neutralizes the remaining generated source. 4. The script constructs the `node -e` program with that value embedded as code. 5. Node.js executes the injected statements with the privileges of the user running setup. 6. The payload can read `ALIASKIT_API_KEY`, inspect local files, modify the Skill, launch subprocesses, or transmit information over the network. ### Impact Assessment Exploitation results in arbitrary local code executi ...[truncated 336 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.sh:10
Finding: Plaintext Storage and Terminal Disclosure of High-Value Credentials
Content: View full analysis
/dev/null || ALIASKIT_API_KEY="" if [ -z "$ALIASKIT_API_KEY" ]; then echo "No key provided. Run this script again when you have one." exit 1 fi export ALIASKIT_API_KEY fi ``` The API key and card decryption key are written together in plaintext without an explicit restrictive mode: ```javascript const state = { apiKey: process.env.ALIASKIT_API_KEY, identityId: identity.id, email: identity.email, phone: identity.phone_number || null, name: identity.name, dob: identity.date_of_birth || null, cardKey: cardKey, createdAt: new Date().toISOString() }; require('fs').writeFileSync( '$IDENTITY_FILE', JSON.stringify(state, null, 2) ); ``` The same plaintext write is present in both the existing-identity and new-identity setup branches. ### Technical Analysis The script combines several unsafe secret-handling practices: - `read -r` does not disable terminal echo, so a manually entered API key may be visible on screen or captured by terminal recording. - `identity.json` stores the API key and card decryption key in plaintext. - `writeFileSync` does not request a restrictive file mode. Effective permissions therefore depend on the process umask and whether the file already exists. - Runni ...[truncated 1876 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description promises a full persistent digital identity capability, including personal details, payment instruments, messaging, purchases, and MFA support. The actual code chunk is much narrower: it passively checks unread email and SMS messages from AliasKit for an existing identity and prints summaries. While this behavior is loosely related to receiving verification codes or messages, it represents only a small subset of the declared functionality. Because the stated primary purpose is substantially broader than the observed behavior in this chunk, the description does not accurately represent what this code actually does.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger language is extremely broad, covering almost any situation involving identity, communication, verification, or payment material. In an autonomous agent setting, this can cause the skill to activate in many unrelated workflows and silently supply real identity data, receive OTPs, send messages, or support purchases without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill exposes highly sensitive capabilities through documented code paths that read persistent credentials from identity.json and set an API key in the environment, yet it declares no explicit tool scope or permissions boundary. In an agent system, this increases the risk that the skill can be invoked in contexts where access to secrets, identity artifacts, email/SMS flows, and payment operations was not clearly authorized or sandboxed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is designed to reveal stored payment card details and facilitate online purchases, yet the description does not present a strong upfront warning or explicit approval requirement before spending. In context, this is especially dangerous because the same skill also handles persistent identity, inbox access, OTP retrieval, and checkout data, enabling end-to-end financial transactions with minimal friction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill enables sending real emails and SMS from the agent's controlled identity but does not require a clear user warning or confirmation step before acting on the user's behalf. This can lead to impersonation-like behavior, spam, social engineering, or unintended external communications triggered by ambiguous prompts or autonomous workflows.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guardrail says never create a second identity, but earlier examples explicitly include create/list/delete identity operations. This contradiction can cause an agent to provision or delete identities unexpectedly, leading to account sprawl, loss of continuity, release of phone/email resources, or accidental destruction of the primary identity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script writes highly sensitive material to identity.json, including the API key, identity ID, name, date of birth, email, phone number, and a card-related key, without setting restrictive file permissions or warning the user about local secret storage. In this skill’s context, that is especially dangerous because the entire purpose of the skill is to persist real identity and payment-related credentials, so compromise of the local file could directly enable account takeover, impersonation, MFA interception, or payment abuse.
Content: No source excerpt is available for this finding.