Verified Agent Identity

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:35 AM UTC
• Version: 1.0.0

Overview

This identity skill is mostly coherent, but it handles high-value private keys and can store them in plaintext by default, so users should review it carefully before installing.

Install only if you are comfortable letting this skill create or import agent identity private keys and persist identity records under $HOME/.openclaw/billions. Configure BILLIONS_NETWORK_MASTER_KMS_KEY before creating identities, protect that directory as sensitive, avoid using valuable wallet keys with --key, and treat generated verification links/tokens as authentication material. Review or update dependencies before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/shared/storage/keys.js:43

Finding

Private Keys Stored in Plaintext Without Enforced Restrictive Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/shared/storage/keys.js:43-59; scripts/shared/storage/base.js:9-12, 26-31
Vulnerability Type: Plaintext sensitive-data storage and unsafe file permissions
Risk Level: High

Vulnerable Code

scripts/shared/storage/keys.js:43-59:

js

_encodeEntry({ alias, privateKeyHex, createdAt }) {
  const masterKey = getMasterKey();
  if (masterKey) {
    return {
      version: 1,
      provider: "encrypted",
      data: { alias, key: encryptKey(privateKeyHex, masterKey), createdAt },
    };
  }
  return {
    version: 1,
    provider: "plain",
    data: { alias, key: privateKeyHex, createdAt },
  };
}

scripts/shared/storage/base.js:9-12:

js

async ensureDirectory() {
  const dir = path.dirname(this.filePath);
  await fs.mkdir(dir, { recursive: true });
}

scripts/shared/storage/base.js:26-31:

js

async writeFile(data) {
  await this.ensureDirectory();
  const json = JSON.stringify(data, null, 2);
  const tempPath = `${this.filePath}.tmp`;
  await fs.writeFile(tempPath, json, "utf-8");
  await fs.rename(tempPath, this.filePath);
}

Technical Analysis

The key store silently selects the plain provider whenever BILLIONS_NETWORK_MASTER_KMS_KEY is absent or rejected. This writes the raw identity private key into $HOME/.openclaw/billions/kms.json.

The storage implementation does not explicitly create the containing directory with mode 0700 or the temporary key file with mode 0600. Effective permissions therefore depend on the process umask and existing directory permissions. The temporary file is also sensitive because it contains the complete serialized key store before being renamed.

Encryption is optional according to the documented behavior, but plaintext private-key storage is not necessary for the identity functionality and creates a substantial local credential-exposure risk.

...[truncated 1199 chars]

Remediation

View remediation

Remediation Suggestions

1. Make encrypted key storage mandatory instead of silently falling back to plaintext.
2. Fail safely with a clear setup error when no valid master key or secure OS keystore is available.
3. Create $HOME/.openclaw/billions with mode 0700.
4. Create both temporary and final sensitive files with mode 0600, and verify existing permissions before reading or writing.
5. Open the temporary file using exclusive creation semantics to reduce symlink and replacement risks.
6. Prefer an operating-system keychain, hardware-backed keystore, or secret-management service over a JSON key file.
7. If plaintext compatibility must remain, require explicit informed opt-in and display a prominent warning before key generation.
8. Provide a migration utility that encrypts existing plaintext entries and securely replaces the old file.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/verifySignature.js:43

Finding

Authentication Challenges Remain Valid After Successful Verification

Content

View full analysis

Vulnerability Details

File Location: scripts/shared/storage/challenge.js:8-23, 30-33; scripts/verifySignature.js:43-60
Vulnerability Type: Replayable authentication challenge
Risk Level: Medium

Vulnerable Code

scripts/shared/storage/challenge.js:8-23:

js

async save(did, challenge) {
  const entries = await this.readFile();
  const created_at = new Date();

  const index = entries.findIndex((entry) => entry.did === did);

  if (index >= 0) {
    // Update existing entry
    entries[index] = { did, challenge, created_at };
  } else {
    // Add new entry
    entries.push({ did, challenge, created_at });
  }

  await this.writeFile(entries);
}

scripts/shared/storage/challenge.js:30-33:

js

async getChallenge(did) {
  const entry = await this.find(did);
  return entry?.challenge;
}

scripts/verifySignature.js:43-60:

js

// Verify the sender
if (basicMessage.from !== args.did) {
  console.error(
    `Error: Invalid from: expected from ${args.did}, got ${basicMessage.from}`,
  );
  process.exit(1);
}

// Verify the challenge matches
const payload = basicMessage.body;
if (payload.message !== challenge) {
  console.error(
    `Error: Invalid signature: challenge mismatch ${payload.message} !== ${challenge}`,
  );
  process.exit(1);
}

outputSuccess("Signature verified successfully");

Technical Analysis

Challenge records include a creation timestamp, but verification does not inspect that timestamp or enforce an expiration period. After successful signature verification, the challenge is neither deleted nor marked as consumed.

Consequently, a captured valid JWS remains acceptable for the same DID until another challenge overwrites the stored value. The cryptographic signature may be valid, but it no longer proves freshness or a live interaction after its first use.

The generated challenge also comes from a range ...[truncated 1410 chars]

Remediation

View remediation

Remediation Suggestions

1. Assign every challenge a short expiration time and reject expired records during verification.
2. Atomically mark the challenge as consumed or delete it immediately after successful verification.
3. Ensure check-and-consume occurs as one atomic operation to prevent concurrent replay races.
4. Generate challenges with at least 128 bits of entropy, such as crypto.randomBytes(16) or more.
5. Bind each challenge to its DID, verifier, intended purpose, audience, and session identifier.
6. Store an explicit status such as pending, consumed, or expired, together with createdAt, expiresAt, and consumedAt.
7. Avoid placing signed tokens in persistent logs or shell history, and redact them from diagnostic output.
8. Add automated tests confirming that expired and previously consumed tokens are rejected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

md

| `identities.json`  | Identity metadata                                                                  |
| `defaultDid.json`  | Active DID and associated public key                                               |
| `challenges.json`  | Per-DID challenge history                                                          |
| `credentials.json` | Verifiable credentials                                                             |

There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The advertised purpose focuses on identity verification and attestation workflows, but the skill also handles long-term key management and local storage of private material in kms.json. That mismatch is security-relevant because operators may approve the skill for verification tasks without realizing it can create, import, persist, and access sensitive keys.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol. metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } } homepage: https://billions.network/

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

bash

cd scripts && npm inst

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill explicitly identifies a local directory containing private keys, credentials, and profile data, which means the skill has access to highly sensitive authentication material. In an agent context, any overbroad file access, prompt leakage, or follow-on compromise could expose credentials or enable impersonation.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

- `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

ws 8.18.0 is flagged for memory disclosure and memory exhaustion issues, which are meaningful in software that accepts WebSocket connections or processes attacker-controlled frames. Even as a transitive dependency, its presence is dangerous because identity and agent systems commonly expose network-facing APIs where malformed frames could leak memory contents or trigger denial of service.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

brace-expansion 2.0.2 has multiple denial-of-service issues related to pathological expansion patterns that can cause excessive CPU or memory consumption. This is a true vulnerable dependency, though exploitability depends on whether untrusted input is ever passed into globbing or brace expansion logic by build or runtime code.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

fast-uri 3.1.0 is flagged for several parsing and normalization issues that can enable host confusion or SSRF bypasses. In an agent identity stack that may resolve DIDs, fetch schemas, or contact remote registries, URI parsing ambiguities materially increase risk because attacker-controlled endpoints could evade allowlists or origin checks.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

ws 7.5.10 is vulnerable to memory exhaustion from crafted fragmented frames, which can let a remote party degrade availability. If any dependency exposes WebSocket client or server behavior to untrusted peers, this can become an externally triggerable denial-of-service condition.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: underscore==1.13.6 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

underscore 1.13.6 is flagged for uncontrolled recursion in flatten/equality helpers, which can allow denial of service with deeply nested attacker-controlled structures. This is a genuine issue if any RPC, schema, or data-processing path passes untrusted nested objects into those helpers.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

undici 5.29.0 has multiple reported HTTP parsing and smuggling class issues, which are especially relevant in software that makes outbound HTTP requests to registries, issuers, schema hosts, or DID resources. In this skill context, network-facing identity verification logic may consume attacker-influenced URLs or responses, so vulnerable HTTP client behavior can undermine trust boundaries and enable SSRF, poisoning, or protocol confusion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

ws 8.17.1 is flagged for both uninitialized memory disclosure and memory exhaustion, making it a substantive remote attack surface when handling WebSocket traffic. Because agent/identity integrations often communicate over persistent channels, this dependency is more concerning than it would be in an offline-only package.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The credential store writes to credentials.json, indicating direct local persistence of potentially sensitive credential data. In a verified identity/authentication skill, credential disclosure can enable identity correlation, privacy loss, and in some deployments unauthorized use of credential material or proof-related artifacts.

Content

Scanner excerpt · scripts/shared/bootstrap.js (reported line 54)May include surrounding context.

js

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code explicitly falls back to provider: "plain" and writes privateKeyHex directly to disk whenever no master key is available. That means highly sensitive cryptographic material can be silently persisted in plaintext, making theft trivial for any local attacker, backup system, log/archive exposure, or compromised host process with filesystem access. In an identity/authentication skill, compromise of these keys can enable impersonation and unauthorized proof generation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to run npx clawhub@latest install ..., which fetches and executes the latest package version at install time. This creates a supply-chain risk because a compromised or malicious future release could execute arbitrary code on the user's machine or agent host without review.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This second installation command repeats the same unsafe pattern of executing npx clawhub@latest, causing unpinned remote code execution during setup. Because it appears in the human installation path, it broadens exposure to any user following the documentation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documents execution of Node scripts that use environment configuration and likely network access, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent setting, that weakens reviewability and containment because the agent may be permitted to invoke capabilities not clearly disclosed to users or policy systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to create identities and manage them locally before prominently warning that private keys may be stored in plaintext when BILLIONS_NETWORK_MASTER_KMS_KEY is unset. This creates a realistic risk that users will generate sensitive identities under insecure defaults and expose keys through local compromise, backups, or accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code consumes a caller-supplied private key or generates a new one, then derives signing material from it for identity creation. Although the behavior is central to the script, there is no visible confirmation, warning, or disclosure in this file that highly sensitive key material is being handled and should be protected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code sends the full authorization request payload to an external URL shortener, which introduces an unnecessary third-party disclosure point for identity verification metadata and callback information. In an agent-identity skill, this is more sensitive than usual because the payload is directly tied to human-to-agent linking and authentication flows, so logging, retention, compromise, or tampering at the shortener could expose or interfere with verification sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code persists KMS key material to a local file via KeysFileStorage("kms.json") without any protection, encryption, permission hardening, or explicit consent flow. In an identity/authentication skill, leaked signing keys can let an attacker impersonate the agent or user, making this more dangerous than ordinary local caching.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The runtime stores credentials, identities, profiles, DIDs, and challenge data in local files, which can expose sensitive identity and authentication artifacts if the host is shared, compromised, or backed up insecurely. Because this skill handles decentralized identity and proof workflows, local disclosure can reveal credential contents, replayable challenge state, or metadata useful for impersonation and privacy attacks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The code saves identity metadata to storage, which affects user data on disk or backing storage. There is no visible prompt, log, or explanatory comment warning the user that an identity record will be persisted and marked as default.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==13.0.0 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The lockfile includes uuid 13.0.0, which is flagged for a missing buffer bounds check in some namespace-based UUID generation paths when a caller supplies a buffer. This is a real supply-chain risk, though its practical impact depends on whether the application or dependency code reaches the affected API with attacker-influenced parameters.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==9.0.1 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

uuid 9.0.1 is affected by the same bounds-check issue in certain UUID generation variants when a buffer is provided. This is a genuine vulnerable dependency finding, but the severity remains low unless the affected code path is reachable with attacker-controlled inputs.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ajv==8.17.1 — 1 advisory(ies): CVE-2025-69873 (ajv has ReDoS when using `$data` option)

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

ajv 8.17.1 is flagged for ReDoS when the $data option is enabled and attacker-controlled schemas or values are validated. This is a real issue, but exploitability depends on whether the application enables $data and performs validation on untrusted content in a request path.

Content

No source excerpt is available for this finding.