Security audit
Security checks for vulnerabilities and agentic risk
This identity skill mostly matches its stated purpose, but some security-sensitive features can expose content or credentials in ways users would not reasonably expect.
Review this skill carefully before installing. Use it only if you are comfortable with the AIP service receiving identity metadata and signed content, avoid signing sensitive files, avoid sending sensitive replies until the reply path is encrypted, protect aip_credentials.json with strict local permissions, and pin/audit dependencies before using it in a security-sensitive workspace.
scripts/aip.py:237Signing Command Uploads Complete User Content to a Remote Service
scripts/aip.py:443Reply Command Sends Message Content Without End-to-End Encryption
scripts/aip.py:177Private Keys Are Written to Plaintext Files Without Enforced Restrictive Permissions
SKILL.md:31Installation Guidance Uses Unpinned Third-Party Dependencies
scripts/aip.py:44Messaging Uses Incompatible and Incorrect Public-Key Encryption Constructions
The base service URL is taken directly from the AIP_SERVICE_URL environment variable and then used for all network requests, including registration, challenge-response authentication, key rotation, and message operations. In an agent environment, a hostile parent process or workspace configuration could redirect the client to an attacker-controlled service, causing exfiltration of DIDs, usernames, signed challenges, encrypted messages, and even private keys in deprecated registration mode.
req = urllib.request.Request(url, data=body, method=method,
headers={"Content-Type": "application/json"} if body else {})
try:
with urllib.request.urlopen(req, timeout=15) as resp:
return json.loads(resp.read())
except urllib.error.HTTPError as e:
err = e.read().decode()
The documented purpose emphasizes secure identity, signing, and encrypted messaging, but the referenced behavior includes undeclared administrative-style registry access and a reply path that may send plaintext message content. That mismatch is dangerous because users and orchestrators may trust the skill for privacy-sensitive workflows while hidden or under-disclosed behaviors expose metadata, registration data, or message content beyond expected boundaries.
The skill explicitly stores a private key in a local JSON credential file and supports path selection via an environment variable, which creates a high-value target for theft or misuse if filesystem permissions, logging, backups, or path handling are weak. In the context of an identity skill, compromise of this file enables impersonation, fraudulent signatures, message decryption, and unauthorized trust actions.
## Credentials
Stored as JSON in `aip_credentials.json`: `{ "did", "public_key", "private_key", "platform", "username" }`.
**Never share `private_key`.** DID and public_key are safe to share.
Set `AIP_CREDENTIALS_PATH` env var to use a custom credential file location instead of the default search path.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
### PATCH /message/\<id\>/read
Mark message as read (requires signature of message_id).
### DELETE /message/\<id\>
Signs: `{message_id}`
---
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from datetime import datetime, timezone
AIP_BASE = os.environ.get("AIP_SERVICE_URL", "https://aip-service.fly.dev")
DEFAULT_CREDS = "aip_credentials.json"
def _find_creds_file(filename=DEFAULT_CREDS):
"""Search for credentials in multiple standard locations."""
The reply command presents itself as replying to a received message, but instead of reusing the encrypted messaging flow it sends plaintext content to a different endpoint. Users may reasonably assume replies are protected like messages, so this mismatch can leak sensitive content to the service or intermediaries and undermines the security guarantees implied by the skill.
The skill advertises commands that require shell execution, network access, environment-variable use, and local file writes, but it does not declare any tool scope or permission boundaries. This creates a transparency and governance gap: an agent may invoke a capability-rich skill without explicit authorization controls, increasing the chance of unintended network calls, credential handling, or filesystem modification.
The description says to use the skill whenever an agent needs identity verification, authentication, trust scoring, secure messaging, or reputation management, followed by a very broad coverage list. This is invocation guidance in a manifest context, and it lacks explicit boundaries or negative examples to distinguish when this skill should not be selected, increasing the chance of unintended activation.
The reference documents destructive and sensitive operations such as message deletion, key rotation, revocation, and admin registration access without warning users that these actions are security-sensitive and potentially irreversible. In a skill meant for autonomous agents handling identity and trust, omission of guardrails increases the chance that an agent or operator invokes high-impact endpoints unsafely or with incomplete authorization assumptions.
The API reference exposes admin-only registration listing and detail endpoints in general documentation without any stated authorization requirements or justification tied to the skill’s end-user identity/trust workflow. In an agent ecosystem, documenting enumeration-capable admin surfaces can encourage misuse, probing, and bulk collection of identity metadata even if the backend is intended to enforce auth.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
with tempfile.NamedTemporaryFile(suffix=".pem", delete=False) as f:
kf = f.name
try:
subprocess.run(["openssl", "genpkey", "-algorithm", "Ed25519", "-out", kf],
check=True, capture_output=True)
raw = subprocess.run(["openssl", "pkey", "-in", kf, "-outform", "DER"],
check=True, capture_output=True).stdout
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
try:
subprocess.run(["openssl", "genpkey", "-algorithm", "Ed25519", "-out", kf],
check=True, capture_output=True)
raw = subprocess.run(["openssl", "pkey", "-in", kf, "-outform", "DER"],
check=True, capture_output=True).stdout
seed = raw[-32:]
pub_raw = subprocess.run(
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
raw = subprocess.run(["openssl", "pkey", "-in", kf, "-outform", "DER"],
check=True, capture_output=True).stdout
seed = raw[-32:]
pub_raw = subprocess.run(
["openssl", "pkey", "-in", kf, "-pubout", "-outform", "DER"],
check=True, capture_output=True).stdout
pub = pub_raw[-32:]
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
with tempfile.NamedTemporaryFile(suffix=".dat", delete=False) as f:
f.write(message)
df = f.name
result = subprocess.run(
["openssl", "pkeyutl", "-sign", "-inkey", kf, "-rawin", "-in", df],
check=True, capture_output=True)
return base64.b64encode(result.stdout).decode()
The registration flow writes a credentials file containing the private key to disk in plaintext. Although the script later mentions backup, it does not provide a meaningful pre-write consent prompt, secure-storage choice, or permission hardening, which is risky in shared agent workspaces where other tools or users may access the file.
Key rotation silently overwrites the credentials file with new private key material, again storing secrets on disk without an explicit warning or secure-storage handling. This can surprise users, disrupt backup expectations, and expose fresh credentials if the file location is accessible to other processes.
The list command exposes bulk registry enumeration through an admin-style endpoint, which exceeds the stated purpose of point identity verification and secure messaging. This enables large-scale discovery of registered identities and associated platform usernames, increasing privacy and reconnaissance risk.
Calling /admin/registrations directly from a general-purpose client enables bulk discovery of all registered agents, which is not required for ordinary identity operations. In context, this increases privacy exposure and makes targeted abuse or scraping easier.
The trust-graph command performs registry-wide enumeration and then queries vouches for each discovered agent to build a global social graph. That creates unnecessary reconnaissance capability and can expose relationship metadata well beyond normal identity verification needs.
The code chains administrative registration listing with per-agent vouch retrieval to perform registry-wide trust reconnaissance. For an identity tool, this broad collection of network relationship data is excessive and raises privacy and targeting concerns.
No suspicious patterns detected.