Verified Agent Identity

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:35 AM UTC
• Version: 1.0.0

Overview

This identity skill is mostly coherent, but it handles high-value private keys and can store them in plaintext by default, so users should review it carefully before installing.

Install only if you are comfortable letting this skill create or import agent identity private keys and persist identity records under $HOME/.openclaw/billions. Configure BILLIONS_NETWORK_MASTER_KMS_KEY before creating identities, protect that directory as sensitive, avoid using valuable wallet keys with --key, and treat generated verification links/tokens as authentication material. Review or update dependencies before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/shared/storage/keys.js:43
• Finding: Private Keys Stored in Plaintext Without Enforced Restrictive Permissions## Vulnerability Details **File Location**: `scripts/shared/storage/keys.js:43-59`; `scripts/shared/storage/base.js:9-12, 26-31` **Vulnerability Type**: Plaintext sensitive-data storage and unsafe file permissions **Risk Level**: High ### Vulnerable Code `scripts/shared/storage/keys.js:43-59`: ```js _encodeEntry({ alias, privateKeyHex, createdAt }) { const masterKey = getMasterKey(); if (masterKey) { return { version: 1, provider: "encrypted", data: { alias, key: encryptKey(privateKeyHex, masterKey), createdAt }, }; } return { version: 1, provider: "plain", data: { alias, key: privateKeyHex, createdAt }, }; } ``` `scripts/shared/storage/base.js:9-12`: ```js async ensureDirectory() { const dir = path.dirname(this.filePath); await fs.mkdir(dir, { recursive: true }); } ``` `scripts/shared/storage/base.js:26-31`: ```js async writeFile(data) { await this.ensureDirectory(); const json = JSON.stringify(data, null, 2); const tempPath = `${this.filePath}.tmp`; await fs.writeFile(tempPath, json, "utf-8"); await fs.rename(tempPath, this.filePath); } ``` ### Technical Analysis The key store silently selects the `plain` provider whenever `BILLIONS_NETWORK_MASTER_KMS_KEY` is absent or rejected. This writes the raw identity private key into `$HOME/.openclaw/billions/kms.json`. The storage implementation does not explicitly create the containing directory with mode `0700` or the temporary key file with mode `0600`. Effective permissions therefore depend on the process umask and existing directory permissions. The temporary file is also sensitive because it contains the complete serialized key store before being renamed. Encryption is optional according to the documented behavior, but plaintext private-key storage is not necessary for the identity functionality and creates a substantial local credential-exposure risk. # ...[truncated 1199 chars]
• Remediation: ## Remediation Suggestions 1. Make encrypted key storage mandatory instead of silently falling back to plaintext. 2. Fail safely with a clear setup error when no valid master key or secure OS keystore is available. 3. Create `$HOME/.openclaw/billions` with mode `0700`. 4. Create both temporary and final sensitive files with mode `0600`, and verify existing permissions before reading or writing. 5. Open the temporary file using exclusive creation semantics to reduce symlink and replacement risks. 6. Prefer an operating-system keychain, hardware-backed keystore, or secret-management service over a JSON key file. 7. If plaintext compatibility must remain, require explicit informed opt-in and display a prominent warning before key generation. 8. Provide a migration utility that encrypts existing plaintext entries and securely replaces the old file.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/verifySignature.js:43
• Finding: Authentication Challenges Remain Valid After Successful Verification## Vulnerability Details **File Location**: `scripts/shared/storage/challenge.js:8-23, 30-33`; `scripts/verifySignature.js:43-60` **Vulnerability Type**: Replayable authentication challenge **Risk Level**: Medium ### Vulnerable Code `scripts/shared/storage/challenge.js:8-23`: ```js async save(did, challenge) { const entries = await this.readFile(); const created_at = new Date(); const index = entries.findIndex((entry) => entry.did === did); if (index >= 0) { // Update existing entry entries[index] = { did, challenge, created_at }; } else { // Add new entry entries.push({ did, challenge, created_at }); } await this.writeFile(entries); } ``` `scripts/shared/storage/challenge.js:30-33`: ```js async getChallenge(did) { const entry = await this.find(did); return entry?.challenge; } ``` `scripts/verifySignature.js:43-60`: ```js // Verify the sender if (basicMessage.from !== args.did) { console.error( `Error: Invalid from: expected from ${args.did}, got ${basicMessage.from}`, ); process.exit(1); } // Verify the challenge matches const payload = basicMessage.body; if (payload.message !== challenge) { console.error( `Error: Invalid signature: challenge mismatch ${payload.message} !== ${challenge}`, ); process.exit(1); } outputSuccess("Signature verified successfully"); ``` ### Technical Analysis Challenge records include a creation timestamp, but verification does not inspect that timestamp or enforce an expiration period. After successful signature verification, the challenge is neither deleted nor marked as consumed. Consequently, a captured valid JWS remains acceptable for the same DID until another challenge overwrites the stored value. The cryptographic signature may be valid, but it no longer proves freshness or a live interaction after its first use. The generated challenge also comes from a range ...[truncated 1410 chars]
• Remediation: ## Remediation Suggestions 1. Assign every challenge a short expiration time and reject expired records during verification. 2. Atomically mark the challenge as consumed or delete it immediately after successful verification. 3. Ensure check-and-consume occurs as one atomic operation to prevent concurrent replay races. 4. Generate challenges with at least 128 bits of entropy, such as `crypto.randomBytes(16)` or more. 5. Bind each challenge to its DID, verifier, intended purpose, audience, and session identifier. 6. Store an explicit status such as `pending`, `consumed`, or `expired`, together with `createdAt`, `expiresAt`, and `consumedAt`. 7. Avoid placing signed tokens in persistent logs or shell history, and redact them from diagnostic output. 8. Add automated tests confirming that expired and previously consumed tokens are rejected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

Credential Access

High

• Category: Privilege Escalation

Content

| `identities.json`  | Identity metadata                                                                  |
| `defaultDid.json`  | Active DID and associated public key                                               |
| `challenges.json`  | Per-DID challenge history                                                          |
| `credentials.json` | Verifiable credentials                                                             |

There are several ways of storing private keys, to enable master key encryption as described in the **KMS Encryption** section below.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The advertised purpose focuses on identity verification and attestation workflows, but the skill also handles long-term key management and local storage of private material in kms.json. That mismatch is security-relevant because operators may approve the skill for verification tasks without realizing it can create, import, persist, and access sensitive keys.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

nk agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentication proofs. Based on iden3 self-sovereign identity protocol.
metadata: { "category": "identity", "clawdbot": { "requires": { "bins": ["node"] }, "config": { "optionalEnv": ["BILLIONS_NETWORK_MASTER_KMS_KEY"] } } }
homepage: https://billions.network/
---

## When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

### After installing the plugin run the following commands to create an identity and link it to your human DID:

```bash
cd scripts && npm inst

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Credential Access

High

• Category: Privilege Escalation

Content

- `kms.json` - **CRITICAL**: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
- `defaultDid.json` - DID identifiers and public keys
- `challenges.json` - Authentication challenges history
- `credentials.json` - Verifiable credentials
- `identities.json` - Identity metadata
- `profiles.json` - Profile data

• Confidence: 84% confidence
• Finding: The skill explicitly identifies a local directory containing private keys, credentials, and profile data, which means the skill has access to highly sensitive authentication material. In an agent context, any overbroad file access, prompt leakage, or follow-on compromise could expose credentials or enable impersonation.

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: ws 8.18.0 is flagged for memory disclosure and memory exhaustion issues, which are meaningful in software that accepts WebSocket connections or processes attacker-controlled frames. Even as a transitive dependency, its presence is dangerous because identity and agent systems commonly expose network-facing APIs where malformed frames could leak memory contents or trigger denial of service.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: brace-expansion 2.0.2 has multiple denial-of-service issues related to pathological expansion patterns that can cause excessive CPU or memory consumption. This is a true vulnerable dependency, though exploitability depends on whether untrusted input is ever passed into globbing or brace expansion logic by build or runtime code.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: fast-uri 3.1.0 is flagged for several parsing and normalization issues that can enable host confusion or SSRF bypasses. In an agent identity stack that may resolve DIDs, fetch schemas, or contact remote registries, URI parsing ambiguities materially increase risk because attacker-controlled endpoints could evade allowlists or origin checks.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: ws 7.5.10 is vulnerable to memory exhaustion from crafted fragmented frames, which can let a remote party degrade availability. If any dependency exposes WebSocket client or server behavior to untrusted peers, this can become an externally triggerable denial-of-service condition.

Known Vulnerable Dependency: underscore==1.13.6 — 1 advisory(ies): CVE-2026-27601 (Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS)

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: underscore 1.13.6 is flagged for uncontrolled recursion in flatten/equality helpers, which can allow denial of service with deeply nested attacker-controlled structures. This is a genuine issue if any RPC, schema, or data-processing path passes untrusted nested objects into those helpers.

Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: undici 5.29.0 has multiple reported HTTP parsing and smuggling class issues, which are especially relevant in software that makes outbound HTTP requests to registries, issuers, schema hosts, or DID resources. In this skill context, network-facing identity verification logic may consume attacker-influenced URLs or responses, so vulnerable HTTP client behavior can undermine trust boundaries and enable SSRF, poisoning, or protocol confusion.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: ws 8.17.1 is flagged for both uninitialized memory disclosure and memory exhaustion, making it a substantive remote attack surface when handling WebSocket traffic. Because agent/identity integrations often communicate over persistent channels, this dependency is more concerning than it would be in an offline-only package.

Credential Access

High

• Category: Privilege Escalation

Content

function newDataStorage(ethStateStorage) {
  return {
    credential: new CredentialStorage(
      new IdentitiesFileStorage("credentials.json"),
    ),
    identity: new IdentityStorage(
      new IdentitiesFileStorage("identities.json"),

• Confidence: 84% confidence
• Finding: The credential store writes to `credentials.json`, indicating direct local persistence of potentially sensitive credential data. In a verified identity/authentication skill, credential disclosure can enable identity correlation, privacy loss, and in some deployments unauthorized use of credential material or proof-related artifacts.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: This code explicitly falls back to provider: "plain" and writes privateKeyHex directly to disk whenever no master key is available. That means highly sensitive cryptographic material can be silently persisted in plaintext, making theft trivial for any local attacker, backup system, log/archive exposure, or compromised host process with filesystem access. In an identity/authentication skill, compromise of these keys can enable impersonation and unauthorized proof generation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The README instructs users to run `npx clawhub@latest install ...`, which fetches and executes the latest package version at install time. This creates a supply-chain risk because a compromised or malicious future release could execute arbitrary code on the user's machine or agent host without review.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: This second installation command repeats the same unsafe pattern of executing `npx clawhub@latest`, causing unpinned remote code execution during setup. Because it appears in the human installation path, it broadens exposure to any user following the documentation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documents execution of Node scripts that use environment configuration and likely network access, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent setting, that weakens reviewability and containment because the agent may be permitted to invoke capabilities not clearly disclosed to users or policy systems.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to create identities and manage them locally before prominently warning that private keys may be stored in plaintext when BILLIONS_NETWORK_MASTER_KMS_KEY is unset. This creates a realistic risk that users will generate sensitive identities under insecure defaults and expose keys through local compromise, backups, or accidental disclosure.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code consumes a caller-supplied private key or generates a new one, then derives signing material from it for identity creation. Although the behavior is central to the script, there is no visible confirmation, warning, or disclosure in this file that highly sensitive key material is being handled and should be protected.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code sends the full authorization request payload to an external URL shortener, which introduces an unnecessary third-party disclosure point for identity verification metadata and callback information. In an agent-identity skill, this is more sensitive than usual because the payload is directly tied to human-to-agent linking and authentication flows, so logging, retention, compromise, or tampering at the shortener could expose or interfere with verification sessions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code persists KMS key material to a local file via `KeysFileStorage("kms.json")` without any protection, encryption, permission hardening, or explicit consent flow. In an identity/authentication skill, leaked signing keys can let an attacker impersonate the agent or user, making this more dangerous than ordinary local caching.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The runtime stores credentials, identities, profiles, DIDs, and challenge data in local files, which can expose sensitive identity and authentication artifacts if the host is shared, compromised, or backed up insecurely. Because this skill handles decentralized identity and proof workflows, local disclosure can reveal credential contents, replayable challenge state, or metadata useful for impersonation and privacy attacks.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The code saves identity metadata to storage, which affects user data on disk or backing storage. There is no visible prompt, log, or explanatory comment warning the user that an identity record will be persisted and marked as default.

Known Vulnerable Dependency: uuid==13.0.0 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The lockfile includes uuid 13.0.0, which is flagged for a missing buffer bounds check in some namespace-based UUID generation paths when a caller supplies a buffer. This is a real supply-chain risk, though its practical impact depends on whether the application or dependency code reaches the affected API with attacker-influenced parameters.

Known Vulnerable Dependency: uuid==9.0.1 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: uuid 9.0.1 is affected by the same bounds-check issue in certain UUID generation variants when a buffer is provided. This is a genuine vulnerable dependency finding, but the severity remains low unless the affected code path is reachable with attacker-controlled inputs.

Known Vulnerable Dependency: ajv==8.17.1 — 1 advisory(ies): CVE-2025-69873 (ajv has ReDoS when using `$data` option)

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: ajv 8.17.1 is flagged for ReDoS when the $data option is enabled and attacker-controlled schemas or values are validated. This is a real issue, but exploitability depends on whether the application enables $data and performs validation on untrusted content in a request path.

Static analysis

No suspicious patterns detected.