Security audit

Agent Identity

Security checks for vulnerabilities and agentic risk

Overview

This identity skill does what it says, but it needs review because it can create long-lived private keys insecurely and can write key files outside the intended folder.

Review before installing in any environment where agent keys matter. Use only in an isolated, non-privileged environment, provide a password for generated keys, restrict key-directory permissions yourself, avoid command-line passwords for real secrets, and use simple safe agent names without slashes or parent-directory components.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: identity.py:31
Finding: Private keys may be stored unencrypted with inherited filesystem permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: identity.py:47
Finding: Unsanitized agent names permit writes outside the intended key directory
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:5
Finding: Cryptography dependency is installed without version or integrity pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description limits the skill's purpose to signing and verifying agent messages, but the code also creates new private/public key material on disk and constructs signed agent identity cards with metadata like capabilities and endpoints. Key management and agent-card issuance are broader identity-management functions than the narrower manifest description suggests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Ed25519 private key may be serialized with NoEncryption() when no password is supplied, causing sensitive signing material to be stored on disk in plaintext. In an agent environment, compromise of the host, workspace, backups, or logs exposing the file path can lead to key theft and full impersonation of the agent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The RSA private key may likewise be written using NoEncryption() when no password is provided, leaving long-lived private key material exposed at rest. If an attacker obtains the file, they can forge signatures, impersonate the agent, and undermine any trust model built on this identity mechanism.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.