codevasp-travel-rule-guide

SUSPICIOUS. The skill’s stated purpose and local-documentation behavior are mostly coherent and there is no clear malicious or deceptive logic in the skill itself. Risk comes from the official CodeVASP integration path relying on a Dockerized Cipher component that receives credentials and private key material via an AWS-hosted registry flow without strong public release-verification evidence, making this a medium supply-chain and credential-handling concern rather than confirmed malware.

The code pattern is legitimate for signed API calls but embeds hardcoded cryptographic material, which is unacceptable for production or supply-chain code. Risks include secret exposure, potential misuse if keys are committed to public repos, and inadequate error handling for HTTP/JSON responses. Improvements should include removing embedded keys, loading credentials from a secure store or environment, adding HTTP timeouts, validating/parsing responses safely, and limiting logging of sensitive data.

The code demonstrates elevated security risk due to hardcoded private key material, exposure of cryptographic artifacts in logs, and an outbound network call from test code. Although no explicit malware indicators are present, this pattern is unsafe for supply-chain code. Recommended mitigations include removing hardcoded credentials, using secure secret management (environment variables, vaults), parameterizing inputs, avoiding logging sensitive data, and introducing mocks/fixtures for network calls in tests with proper error handling and destination validation.