T09 · Insecure Skill Coding Practices
Error
- Location
scripts/register.js:50- Finding
JSON Output Mode Bypasses Registration Transaction Confirmation
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Identity Protocol
Security checks for vulnerabilities and agentic risk
Overview
This skill fits its stated identity purpose, but it needs Review because documented JSON-mode transaction commands can bypass the intended confirmation step and it stores signing keys locally.
Review before installing. Use a dedicated testnet or low-value identity key, avoid importing private keys through --import, verify contract and chain settings, and do not run register or vouch with --json unless the code is fixed to require explicit confirmation independently from output format.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/vouch.js:54- Finding
JSON Output Mode Bypasses Vouch Transaction Confirmation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.js:12- Finding
Private Key Import Through Command-Line Arguments Exposes Wallet Secrets
- Content
View full analysis
', 'Import existing private key') .parse(); const opts = program.opts(); let privateKey; if (opts.import) { // Import existing key privateKey = opts.import.startsWith('0x') ? opts.import : `0x${opts.import}`; } else { // Generate new keypair privateKey = generatePrivateKey(); } const account = privateKeyToAccount(privateKey); const keyData = { address: account.address, privateKey: privateKey, createdAt: new Date().toISOString(), identityHash: null, // Set after registration }; saveKey(keyData); ``` ### Technical Analysis The setup command accepts a raw EVM private key as a command-line argument. Command-line secrets can be exposed through several channels outside the application's control, including: - Shell history files. - Process-list or process-inspection interfaces while the command is running. - Terminal session recording. - CI/CD command logs. - Automation telemetry and agent execution transcripts. - Wrapper scripts that log complete command lines. Although `saveKey()` writes the resulting key file with restrictive permissions, that does not protect the earlier exposure through `argv`. An EVM private key is a bearer credential: possession is sufficient to sign messages and transactions. ### Attack Path 1. A user imports an existing key with `node scripts/setup.js --import `. 2. The shell or automation environment records the complete command. 3. A local user, administrator, log reader, CI operator, or compromised monitoring component retrieves the argument. 4. The attacker impo ...[truncated 1089 chars]- Remediation
View remediation
` option. - Read the key from a hidden interactive prompt that disables terminal echo. - For automation, accept the key through standard input or a permission-restricted file descriptor rather than `argv`. - If file-based import is supported, verify ownership and reject files accessible by group or other users. - Avoid environment variables for long-lived secrets because they can also be exposed through process environments and diagnostic tooling. - Clear temporary in-memory buffers where practical, while recognizing that JavaScript cannot guarantee secure memory erasure. - Warn users to remove any historical commands or logs containing keys and to rotate any key previously imported through this interface. - Prefer a dedicated identity signing key separated from the wallet holding financial assets, reducing the impact if one key is compromised. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (16)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Although not overtly malicious, the installation instructions ask users to recursively delete a path with
rm -rfduring setup. If copied, modified, or run in an unexpected environment, destructive deletion commands can amplify mistakes; this is more concerning here because the skill already requires shell execution of unreviewed setup steps from a remote repository.- Content
mkdir -p "$SKILL_DIR" git clone https://github.com/g1itchbot8888-del/agent-identity.git /tmp/agent-identity-tmp cp -r /tmp/agent-identity-tmp/skill/* "$SKILL_DIR/" rm -rf /tmp/agent-identity-tmp cd "$SKILL_DIR" && npm install
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Although not overtly malicious, the installation instructions ask users to recursively delete a path with
rm -rfduring setup. If copied, modified, or run in an unexpected environment, destructive deletion commands can amplify mistakes; this is more concerning here because the skill already requires shell execution of unreviewed setup steps from a remote repository.- Content
mkdir -p "$SKILL_DIR" git clone https://github.com/g1itchbot8888-del/agent-identity.git /tmp/agent-identity-tmp cp -r /tmp/agent-identity-tmp/skill/* "$SKILL_DIR/" rm -rf /tmp/agent-identity-tmp cd "$SKILL_DIR" && npm install
text
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/setup.js --json
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares executable setup and runtime commands (
git clone,npm install,node scripts/...) and implicitly relies on environment access, but it does not declare any explicit tool scope or permissions. This creates an under-specified trust boundary where an agent may execute code or access environment data without users understanding the required capabilities.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Features - **Register** — Create on-chain identity (stake USDC to prevent spam) - **Sign** — Sign messages with your identity key - **Verify** — Verify signatures from other agents - **Link** — Connect platform accounts (Moltbook, Twitter, etc.)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The setup instructions create a persistent private signing key in
~/.agent-identity/key.json, but the guidance does not clearly warn that loss, disclosure, or accidental syncing of this file could permanently compromise the identity. For a cryptographic identity skill, inadequate key-handling guidance increases the chance of credential theft or unrecoverable identity loss.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The registration flow instructs users to submit on-chain staking transactions involving USDC without a prominent warning that blockchain transactions may be irreversible, incur gas costs, and expose users to financial loss from mistakes or contract issues. Because the skill is centered on staking and vouching, insufficient financial-risk disclosure can lead users to authorize transfers they do not fully understand.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## Security - Private key stored in `~/.agent-identity/key.json` (chmod 600) - Never share your private key - Signing key can be different from wallet key for added security - USDC stake is returned after deactivation cooldown (7 days)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code persists key material to a predictable file in the user's home directory as plaintext JSON. Although restrictive filesystem modes are set, local plaintext storage of a private key materially increases the risk of compromise from malware, backups, multi-user access mistakes, or later code that reads the file, especially in a skill designed to control on-chain identity and funds.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The wallet client loads a locally stored private key and couples it to remote HTTP RPC interaction for transaction signing and submission. In the context of an agent identity skill that can register identities and stake USDC, this increases the blast radius of any key compromise or mis-signing flow, and users are not warned that local key material will be used to authorize on-chain actions through an external endpoint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This script accepts a private key via a command-line argument and persists the private key to disk, but it does not provide any explicit warning about the sensitivity of the credential or the risks of exposing it through shell history, process listings, logs, or insecure file storage. In the context of an on-chain identity and staking tool, compromise of this key could let an attacker impersonate the agent, sign messages, and steal or misuse associated funds and identity.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
js .requiredOption('--amount <usdc>', 'USDC amount to stake as vouch') .option('--chain <name>', 'Chain to use', DEFAULT_CHAIN) .option('--json', 'Output as JSON') .option('--yes', 'Skip confirmation') .parse(); const opts = program.opts();
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
js .requiredOption('--amount <usdc>', 'USDC amount to stake as vouch') .option('--chain <name>', 'Chain to use', DEFAULT_CHAIN) .option('--json', 'Output as JSON') .option('--yes', 'Skip confirmation') .parse(); const opts = program.opts();
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
The dependency uses a caret version range, which allows newer minor/patch releases of
viemto be installed without explicit review. In a security-sensitive skill that performs cryptographic identity, signing, verification, and on-chain registration, this increases supply-chain risk because an upstream compromise or breaking change could alter signing or transaction behavior.- Content
json "vouch": "node scripts/vouch.js" }, "dependencies": { "viem": "^2.0.0", "commander": "^11.0.0" }, "author": "g1itchbot",
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The
commanderdependency is also specified with a caret range, so installs may resolve to newer releases that were not explicitly vetted. Whilecommanderis not itself a crypto library, it is part of the execution path for CLI scripts, so a compromised or vulnerable upstream release could still affect local command execution or be used as a supply-chain entry point.- Content
json }, "dependencies": { "viem": "^2.0.0", "commander": "^11.0.0" }, "author": "g1itchbot", "license": "MIT"
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The code creates a public client using http() transport, which will send requests to a remote RPC service and may transmit wallet- or chain-related metadata. This file does not include any prompt, log, or explanatory warning to the user about external network communication.
- Content
Static analysis
No suspicious patterns detected.