ClawHub
Back to skill

Security audit

Sovereign Identity

Security checks for vulnerabilities and agentic risk

Overview

This identity skill is purpose-aligned, but its signing and verification workflows handle high-value identity keys and mandates with under-enforced safeguards.

Review this carefully before installing. Use it only in an isolated environment with a strong CLAW_PASSWORD, do not treat generated mandates as authoritative without independent issuer/key validation, avoid using real personal claims with the selective-disclosure script, and pin dependencies before running npm or npx commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
.agent/skills/identity-sovereign/scripts/verify_did.ts:17
Finding

Untrusted public-key substitution allows forged mandates

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
.agent/skills/identity-sovereign/scripts/onboard.ts:81
Finding

Encrypted master identity is created without restrictive file permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
.agent/skills/identity-sovereign/scripts/guardrail.ts:6
Finding

Advertised mandatory guardrail is not integrated and accepts incomplete input

Content
View full analysis
{ try { const data = JSON.parse(input); const keys = Object.keys(data); const allowedKeys = ["iss", "sub", "aud", "iat", "exp", "jti", "claims"]; // Check if all keys in input are allowed const isSafe = keys.every((k) => allowedKeys.includes(k)); if (!isSafe) return false; // Explicitly deny if ANY value looks like a key const valStr = JSON.stringify(data).toLowerCase(); if (valStr.includes("private key") || valStr.includes("secret")) return false; return true; } catch { return false; } }, ]; function strictScan(input: string) { let matched = false; for (const rule of ALLOWED_SCHEMAS) { if (rule instanceof RegExp) { if (rule.test(input)) matched = true; } else if (typeof rule === "function") { if (rule(input)) matched = true; } } if (!matched) { throw new Error( `SECURITY ALERT: Input rejected by strict allow-list policy. "${input.substring(0, 20)}..." is not a recognized safe pattern.`, ); } console.log("✅ Strict Safety Check Passed."); } const args = process.argv.slice(2); if (args.length > 0) { const input = args.join(" "); try { strictScan(input); } catch (error: any) { console.error(error.message); process.exit(1); } } else { // No args = pass for simple execution checks, or fail? // User requested "Strict Input Validation". // If running with no args, it might be just checking the script itself ...[truncated 2153 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
.agent/skills/identity-sovereign/scripts/selective_disclosure.ts:34
Finding

Complete selective-disclosure token exposes every hidden claim in logs

Content
View full analysis
= { _sd: [], }; for (const [key, value] of Object.entries(sensitiveClaims)) { const disclosure = createDisclosure(key, value); const disclosureStr = JSON.stringify(disclosure); const disclosureB64 = Buffer.from(disclosureStr).toString("base64url"); disclosures.push(disclosureB64); const hash = hashDisclosure(disclosure); hashes.push(hash); sdClaims._sd.push(hash); } // 4. Create the JWT Payload const payload = { iss: "did:key:issuer", sub: "did:key:subject", iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 3600, ...sdClaims, }; console.log( "JWT Payload (with hidden claims):", JSON.stringify(payload, null, 2), ); // 5. Sign the JWT const jwt = await new jose.SignJWT(payload) .setProtectedHeader({ alg: "EdDSA" }) .sign(privateKey); // 6. Append Disclosures (The SD-JWT Format utils) // Format: ~~~...~ const sdJwt = `${jwt}~${disclosures.join("~")}~`; console.log("\nComplete SD-JWT:"); console.log(sdJwt); ``` ### Technical Analysis Each disclosure is only base64url-encoded, not encrypted. Anyone who obtains the complete SD-JWT can decode the disclosure arrays and recover all claim names and values. The script writes the complete token—including every disclosure—to standard output before creating the reduced presentation. In environments where console output is collected by an Agent framework, CI serv ...[truncated 1384 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
package.json:34
Finding

Unpinned dependency resolution and npx execution make installations non-reproducible

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (28)

Concealed Executable Artifact

High
Category
Supply Chain
Confidence
100% confidence
Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Concealed Executable Artifact

High
Category
Supply Chain
Confidence
100% confidence
Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Concealed Executable Artifact

High
Category
Supply Chain
Confidence
100% confidence
Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Concealed Executable Artifact

High
Category
Supply Chain
Confidence
100% confidence
Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Concealed Executable Artifact

High
Category
Supply Chain
Confidence
100% confidence
Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Concealed Executable Artifact

High
Category
Supply Chain
Confidence
100% confidence
Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The contributing guide instructs users to run npx tsx scripts/e2e_test.ts without pinning a specific package version. If tsx is not already installed locally, npx may fetch the latest package at execution time, creating a supply-chain risk where contributors execute unreviewed code that could change over time or be compromised upstream. In contributor documentation, this is moderately dangerous because users may copy-paste the command directly in a development environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 85)May include surrounding context.

md
## Directory Structure

- `.agent/skills/identity-sovereign/SKILL.md`: The Brain & Decision Matrix.
- `schema/`: JSON schemas.
- `scripts/`: TypeScript implementation of DID/VC/SD-JWT logic.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The routing logic relies on broad keyword matching such as 'sign', 'buy', 'access', and 'view', which can misclassify user intent and cause the agent to select a higher-privilege identity persona or attach proofs unnecessarily. In an identity-management skill, incorrect persona selection can lead to over-disclosure, unintended use of a corporate identity, or accidental mandate signing in contexts that only required low-privilege browsing access.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The test script invokes npx tsx, which can fetch and execute a package version at runtime if the dependency is missing or resolution is manipulated. In a security-sensitive identity skill, this increases supply-chain risk because arbitrary code could run during testing or CI from an unpinned toolchain component.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The skill is explicitly about managing DIDs and privacy-preserving identity proofs, so describing DID generation as creating a "decrypted identifier" conflicts with the documented intent and meaning of the tool. This is not just incomplete wording; it states a different concept than the surrounding purpose and privacy guidance.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 38)May include surrounding context.

json
"test": "npx tsx .agent/skills/identity-sovereign/scripts/e2e_test.ts"
  },
  "devDependencies": {
    "@types/bs58": "^4.0.4",
    "@types/node": "^18.19.130",
    "ts-node": "^10.9.1",
    "tsx": "^4.7.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 39)May include surrounding context.

json
},
  "devDependencies": {
    "@types/bs58": "^4.0.4",
    "@types/node": "^18.19.130",
    "ts-node": "^10.9.1",
    "tsx": "^4.7.0",
    "typescript": "^5.0.0"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 40)May include surrounding context.

json
"devDependencies": {
    "@types/bs58": "^4.0.4",
    "@types/node": "^18.19.130",
    "ts-node": "^10.9.1",
    "tsx": "^4.7.0",
    "typescript": "^5.0.0"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 41)May include surrounding context.

json
"@types/bs58": "^4.0.4",
    "@types/node": "^18.19.130",
    "ts-node": "^10.9.1",
    "tsx": "^4.7.0",
    "typescript": "^5.0.0"
  },
  "dependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 42)May include surrounding context.

json
"@types/node": "^18.19.130",
    "ts-node": "^10.9.1",
    "tsx": "^4.7.0",
    "typescript": "^5.0.0"
  },
  "dependencies": {
    "bs58": "^6.0.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 45)May include surrounding context.

json
"typescript": "^5.0.0"
  },
  "dependencies": {
    "bs58": "^6.0.0",
    "dotenv": "^17.3.1",
    "jose": "^6.1.3"
  }

Static analysis

No suspicious patterns detected.