Audit verifier trust controls for credential acceptance workflows.
npx skills add https://github.com/blamejs/exceptd-skills --skill vc-wallet-trust
Please help me install this Agent Skill. Skill: vc-wallet-trust Source: https://github.com/blamejs/exceptd-skills/tree/main/skills/vc-wallet-trust Command: npx skills add https://github.com/blamejs/exceptd-skills --skill vc-wallet-trust
Existing identity and compliance frameworks (NIST 800-53, ISO 27001, NIS2) were designed for traditional network-centric authentication and lack controls for verifiable credential and digital wallet trust verification. This leaves verifiers vulnerable to accepting forged, revoked, or replayed credentials from unanchored issuers, unread status lists, or unbound presentations, creating unaddressed security gaps for EUDI wallet, mobile driving licence, and other VC use cases.
Use the vc-wallet-trust skill to audit your digital wallet verifier's trust controls for SD-JWT-VC, OID4VP, and mdoc credential acceptance paths to identify forged, revoked, or replayed credential risks.
High-intent search queries and answers about installing and using this skill.
This skill audits verifier trust controls for EUDI wallet and mdoc workflows by mapping security gaps to MITRE ATT&CK TTPs, identifying missing issuer anchor pinning, revocation enforcement, and presentation binding to block forged, revoked, and replayed credential attacks.
Security gaps in SD-JWT-VC and OID4VP acceptance include missing trust anchor pinning, unread revocation status lists, and unbound presentations, which allow attackers to bypass credential verification and gain unauthorized access to age-gated services or identity systems.
Map digital wallet verifier vulnerabilities by correlating trust failures like unanchored issuers and unbound presentations to MITRE ATT&CK TTPs such as T1556, T1550, and T1606, alongside CWE weaknesses, to identify exploitable credential verification bypasses.
Traditional frameworks like NIST 800-53 and ISO 27001 lack specific controls for mobile driving licence trust verification, requiring targeted audits for issuer anchor pinning and revocation enforcement to satisfy identity control compliance requirements.
The best way to prevent replayed verifiable credential attacks in mdoc verification is enforcing nonce and audience presentation binding during the verifier audit procedure to ensure the credential presentation is cryptographically bound to the specific transaction session.
You need a dedicated trust verification audit for NIS2 compliance when implementing EUDI wallet or SD-JWT-VC acceptance, as traditional network-centric identity controls fail to address forged, revoked, or replayed credential risks from unanchored issuers.
sourcelabbgDefine PID attributes and encoding specifications for EUDI Wallet ecosystems.
josemlopezMap threats and controls to compliance frameworks and generate audit-ready reports.
copyleftdevMap adversary TTPs to MITRE ATT&CK techniques for detection engineering.
sourcelabbgGuide SD-JWT and SD-JWT VC issuer, holder, and verifier implementation.
