EvoMap Node Controller

• Outcome: Review
• Latest audit: May 28, 2026 · 7:40 AM UTC
• Version: 2.1.0

Overview

This skill appears to be a real EvoMap node controller, but it can use local SSH keys to run root commands on hard-coded servers and start or stop persistent processes with limited safeguards.

Install only if you intentionally want this skill to control the listed EvoMap hosts using the listed SSH key paths as root. Prefer a revised version that uses explicit user-provided configuration, requires confirmation for each start or stop target, keeps SSH host-key checking enabled, and manages the node process through systemd, pm2, or a PID file instead of broad nohup and pkill commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill is presented as a general EvoMap node manager, but it embeds hard-coded public IPs, root SSH access, private key paths, and local process inspection logic. In an agent-skill context, this creates undisclosed privileged control over specific infrastructure and broadens the skill's effective scope beyond normal node management into direct system administration of named hosts and the local machine.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Using SSH with StrictHostKeyChecking=no disables host identity verification, allowing man-in-the-middle interception or redirection of privileged commands. Because the command runs as root and starts a persistent process remotely, an attacker who can influence network paths or DNS/routing could capture commands or cause them to execute on an attacker-controlled host.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The status routine inspects a local process on an undeclared machine labeled as another region, even though the skill metadata focuses on managing EvoMap nodes on servers. In an agent environment, this can leak information about the host where the skill is running and silently extends monitoring scope to the local system without clear authorization.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill includes direct kill commands using `pkill -f 'node index.js'` on local and remote systems without any warning, scope limitation, or confirmation guidance. This can terminate unintended processes that match the pattern and can cause service disruption, especially because the commands run as root on remote hosts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill can start and stop remote processes over SSH on external servers without any built-in warning, approval, guardrail, or confirmation flow. In a conversational agent setting, that makes destructive or operationally sensitive actions too easy to trigger, increasing the risk of accidental outages or abuse through prompt manipulation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code embeds sensitive SSH key paths and specific remote administration details directly in the skill definition. Even if the private keys are not included, exposing credential locations and access patterns materially helps an attacker understand the environment and encourages unsafe secret handling in code.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 深海
ssh -i $CENTRAL_SSH_KEY root@$CENTRAL_IP "cd ~/.openclaw/evolver && A2A_HUB_URL=https://evomap.ai A2A_NODE_ID=<your_node_id> nohup $NODE_PATH index.js run --loop > ~/.openclaw/logs/evolver.log 2>&1 &"

# 泰拉
ssh -i $TOKYO_SSH_KEY root@$TOKYO_IP "cd ~/.openclaw/evolver && A2A_HUB_URL=https://evomap.ai A2A_NODE_ID=<your_node_id> nohup node index.js run --loop > ~/.openclaw/logs/evolver.log 2>&1 &"

• Confidence: 87% confidence
• Finding: Using `nohup ... &` intentionally creates a long-running background process that persists after the session ends. In this context that may be operationally intended, but it is still security-relevant because it establishes unattended execution on a remote root account without lifecycle controls, making misuse, drift, and stealthier persistence more likely.

Session Persistence

Medium

• Category: Rogue Agent

Content

ssh -i $CENTRAL_SSH_KEY root@$CENTRAL_IP "cd ~/.openclaw/evolver && A2A_HUB_URL=https://evomap.ai A2A_NODE_ID=<your_node_id> nohup $NODE_PATH index.js run --loop > ~/.openclaw/logs/evolver.log 2>&1 &"

# 泰拉
ssh -i $TOKYO_SSH_KEY root@$TOKYO_IP "cd ~/.openclaw/evolver && A2A_HUB_URL=https://evomap.ai A2A_NODE_ID=<your_node_id> nohup node index.js run --loop > ~/.openclaw/logs/evolver.log 2>&1 &"
```

## 检查节点状态

• Confidence: 87% confidence
• Finding: This command similarly launches a detached long-lived process on a remote host using `nohup` and backgrounding. Although it serves the advertised node-control purpose, the persistence mechanism is ad hoc and increases risk because the process survives logout and may be harder to audit, constrain, or terminate safely.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:22