identity-aiops

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:40 PM UTC
• Version: 0.8.2

Overview

This skill is for legitimate identity-provider administration, but it can perform high-impact account and OAuth changes while its approval/governance language is inconsistent and the executable package is installed unpinned.

Install only after pinning or verifying the identity-aiops package you will run. Start with a view-only Keycloak service account or authentik token, grant manage permissions only when needed, and do not rely on the approval environment variables as enforcement because the artifact says they are audit annotations only.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:77
• Finding: Unpinned External Package and Plugin Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:77-85` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash uv tool install identity-aiops identity-aiops init # wizard: pick platform (keycloak/authentik) + encrypted secret identity-aiops doctor ``` ```bash openclaw plugins install clawhub:@zw008/identity-aiops openclaw skills info identity-aiops # expect: Visible to model: yes ``` ### Technical Analysis The installation instructions resolve `identity-aiops` and the associated ClawHub plugin without specifying an immutable version, package hash, verified signature, or lockfile. The audited project contains documentation only; it does not include the installed package's implementation. Consequently, the behavior of the software ultimately executed cannot be verified from this repository. The installation endpoints appear consistent with the Skill's declared functionality, and there is no evidence that the named package or publisher is malicious. However, the effective executable payload can change after this Skill has been reviewed. A compromised publisher account, package registry, plugin registry, or later upstream release could cause users to install code different from the reviewed release. This is best classified as an insecure dependency and supply-chain weakness rather than confirmed remote malicious payload execution because no malicious upstream artifact or direct arbitrary-URL execution was identified. ### Attack Path 1. An attacker compromises the upstream package publisher, ClawHub publisher, or distribution infrastructure. 2. The attacker publishes a modified release under the same unversioned package or plugin identifier. 3. A user follows the documented installation command. 4. The package manager resolves the latest attacker-controlled release because no immutable version or integrity constraint is present. 5. The installed executable runs with the invoking u ...[truncated 1248 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every installation command to a specific, audited release rather than resolving the latest release. 2. Publish and verify cryptographic hashes or signed provenance for package and plugin artifacts. 3. Provide a lockfile or equivalent reproducible dependency manifest covering transitive dependencies. 4. Link the pinned artifacts to the exact source commit from which they were built. 5. Prefer registry mechanisms that support trusted publishing, package signing, and provenance attestations. 6. Document a verification procedure that confirms the downloaded artifact's version, hash, and publisher identity before execution. 7. Recommend initially connecting the tool with a view-only IdP account and granting management roles only after the pinned build has been validated. 8. Avoid placing the master password directly in broadly inherited environments; use a narrowly scoped secret-injection mechanism where supported. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/setup-guide.md:11
• Finding: Setup Guide Recommends Unpinned Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `references/setup-guide.md:11` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash uv tool install identity-aiops # or: pipx install identity-aiops ``` ### Technical Analysis The setup guide recommends installing the external `identity-aiops` package through `uv` or `pipx` without a version constraint, integrity hash, signature check, or reproducible dependency lock. Both installation paths can therefore resolve a future package release that was not part of this audit. This repository does not contain the external package's source code, so claims concerning encrypted secret handling, network destinations, audit behavior, and write governance cannot be independently validated against the actual installed implementation. The documented network behavior—sending credentials to an operator-configured Keycloak or authentik endpoint—is necessary for the declared identity-management function, but an altered dependency could deviate from that design. No evidence of an existing malicious package, credential-exfiltration endpoint, or hidden installation script was found in the audited files. ### Attack Path 1. An attacker gains the ability to publish or substitute the `identity-aiops` package. 2. The attacker uploads a modified release under the expected package name. 3. A user runs the documented unpinned `uv` or `pipx` command. 4. The package resolver installs the modified current release and its dependencies. 5. The user invokes setup, health-check, CLI, or MCP functionality. 6. The compromised implementation executes locally and may access configuration data and identity-provider credentials supplied during normal operation. ### Impact Assessment Successful exploitation provides code execution in the context of the user running the package. Because the package is intended to handle administrative identity credentials, a malicious version could poten ...[truncated 406 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace unversioned examples with an exact audited package version. 2. Require hash verification where supported, and publish the expected artifact hashes through a trusted channel. 3. Pin transitive dependencies through a reviewed lockfile. 4. Publish signed release artifacts and verifiable build provenance. 5. Include the corresponding implementation source in the audit scope or provide a verifiable mapping between the package artifact and its source commit. 6. Test the pinned artifact against a self-hosted laboratory IdP before production use. 7. Retain TLS verification and install trusted private CA certificates instead of disabling certificate validation. 8. Use view-only Keycloak roles or an authentik token without management scope during initial validation. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest and summary repeatedly describe the skill as having a governed write/approval harness, but the body later clarifies that the harness only audits and labels risk and does not actually block dangerous actions. In an identity-administration skill that can disable users, revoke sessions, change redirect URIs, and rotate client secrets, this discrepancy can cause operators or upstream agents to over-trust the control plane and execute destructive writes without real enforcement.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The workflow text says high-risk actions such as re-enabling a user require IDENTITY_AUDIT_APPROVED_BY and IDENTITY_AUDIT_RATIONALE, but the governance section later states those variables are optional and never block. That contradiction can mislead an agent or human reviewer into believing sensitive recovery actions have approval gating when they do not, increasing the chance of unauthorized or premature restoration of access.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The client hardening recipe states redirect-URI replacement requires approval metadata, yet the governance section says approval annotations are optional and non-blocking. Because redirect-URI changes can instantly break SSO flows or broaden OAuth attack surface if done incorrectly, inaccurate claims about approval controls create a dangerous false sense of procedural safety.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
identity-aiops init                 # onboarding wizard (platform, base URL, realm, secret)
identity-aiops doctor               # config + secrets + token acquisition + user-count probe
identity-aiops doctor --skip-auth   # config/secrets checks only (no network)
identity-aiops overview             # one-shot estate summary
identity-aiops mcp                  # start the MCP server (stdio)
```

• Confidence: 70% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

identity-aiops secret set <target>    # store/replace a secret (hidden prompt)
identity-aiops secret list            # target names only — never values
identity-aiops secret remove <target>
identity-aiops secret migrate         # legacy .env / env vars → secrets.enc
```

Master password: `IDENTITY_AIOPS_MASTER_PASSWORD` (non-interactive/MCP) or an

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

metadata: {"openclaw":{"requires":{"anyBins":["identity-aiops","uvx"]},"optional":{"env":["IDENTITY_AIOPS_CONFIG","IDENTITY_AIOPS_MASTER_PASSWORD"]},"homepage":"https://github.com/AIops-tools/Identity-AIops","emoji":"🔐","os":["macos","linux"]}}
compatibility: >
  Standalone, self-governed identity-provider operations across Keycloak (admin REST API /admin/realms/{realm}/..., OAuth2 client-credentials grant against the realm token endpoint with automatic refresh-on-401) and authentik (API v3 /api/v3/..., long-lived API token as a Bearer header). Each target in the config names its own platform, and a name-keyed platform registry selects the API shape, so the same tools work on both and one config can span a mixed estate. The governance harness (audit, policy, token/runaway budget, undo, risk-tiers) is bundled in the package — no external skill-family dependency.
  All write operations are audited to a local SQLite DB under ~/.identity-aiops/ (relocatable via IDENTITY_AIOPS_HOME).
  Credentials: the Keycloak confidential client's client secret or the authentik API token is stored ENCRYPTED in ~/.identity-aiops/secrets.enc (Fernet/AES-128 + scrypt-derived key) — never plaintext on disk. Run 'identity-aiops init' to onboard (it asks for the platform, base URL, and — Keycloak — realm + client_id), or 'identity-aiops secret set <target>' to add one. The store is unlocked by a master password from IDENTITY_AIOPS_MASTER_PASSWORD (non-interactive/MCP/CI) or an interactive prompt (CLI on a TTY). A legacy plaintext env var IDENTITY_<TARGET_NAME_UPPER>_SECRET is still honoured as a fallback with a deprecation warning (migrate with 'identity-aiops secret migrate'). Secrets are held only in memory, never logged or echoed; rotate_client_secret returns and records masked fingerprints only.
  State-changing operations pass through the @governed_tool decorator (budget guard + audit + risk-tier labelling). enable_user, update_client_redirect_uris, and rotate_client_secret are risk=hi
...[truncated 25 chars]

• Confidence: 79% confidence
• Finding: The skill explicitly persists operational audit data and masked prior state in a local SQLite database under the user's home directory. In an identity-operations context, those records may contain sensitive user identifiers, client metadata, action history, and undo context that could aid lateral movement or privacy violations if local filesystem protections are weak or the host is shared.

Session Persistence

Medium

• Category: Rogue Agent

Content

Each recipe starts from a read or one of the four RCAs and ends in a governed
write. The **RCAs are MCP tools** (`login_failure_rca`, `stale_access_audit`,
`client_misconfig_audit`, `mfa_coverage_analysis`) — call them through the MCP
server; the CLI covers the reads and the writes. Every CLI write accepts
`--dry-run` and otherwise double-confirms.

### 1. "We're being brute-forced — contain it"

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool does
not gate it — there is no read-only switch and no approval prompt to configure.
The two right places to control read vs write:

- **The account you connect with.** Give the Keycloak service account (or the

• Confidence: 92% confidence
• Finding: The document explicitly states that the tool does not enforce a read-only mode or approval prompt for write actions, relying instead on external account permissions or the agent prompt. In an agentic setting, prompt-only restrictions are weak and can be bypassed by model error, prompt injection, or misconfiguration, so destructive identity operations like disabling users or revoking sessions may be executed if the connected account is overprivileged.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly exposes write operations that can disable or enable accounts, revoke sessions, force password resets, replace redirect URIs, and rotate client secrets, but the capabilities text does not present a clear user-facing warning about the operational and security consequences of these actions. In an identity-provider administration context, such writes can immediately affect authentication, authorization, and application trust boundaries, so omission of explicit warnings increases the chance of accidental disruptive or unsafe use.

Session Persistence

Medium

• Category: Rogue Agent

Content

# identity-aiops CLI reference

All read commands print normalized JSON. All write commands take `--dry-run`
(preview, no call, no audit) and otherwise require **double confirmation**;
confirmed writes execute through the governed MCP twins, so they land in
`~/.identity-aiops/audit.db` with undo where applicable. `--target/-t` selects

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

```bash
identity-aiops init                 # onboarding wizard (platform, base URL, realm, secret)
identity-aiops doctor               # config + secrets + token acquisition + user-count probe
identity-aiops doctor --skip-auth   # config/secrets checks only (no network)
identity-aiops overview             # one-shot estate summary
identity-aiops mcp                  # start the MCP server (stdio)
```

• Confidence: 80% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Session Persistence

Medium

• Category: Rogue Agent

Content

## 2. What you need per IdP

- **Keycloak** — a **confidential client** with *Client authentication* ON and
  *Service accounts roles* enabled (Clients → Create client). Grant its service
  account the `realm-management` roles the agent should have:
  - reads/analyses only: `view-users`, `view-events`, `view-clients`,
    `view-realm`, `view-identity-providers`

• Confidence: 86% confidence
• Finding: The guide instructs operators to create a long-lived confidential client with service-account access and elevated `realm-management` roles. While framed as operational setup, this creates a persistent machine credential that can continuously access identity administration APIs; if the client secret is exposed, an attacker gains durable administrative visibility and potentially user/client management capability.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 6. Security notes

- Secrets: Fernet-encrypted (scrypt-derived key), chmod 600, never plaintext;
  legacy `IDENTITY_<TARGET>_SECRET` env fallback warns and should be migrated
  (`identity-aiops secret migrate`).
- Least privilege: scope the Keycloak service account / authentik token to the

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/cli-reference.md:28

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/agent-guardrails.md:88