T02 · Agent Memory Poisoning
Warning
- Location
docs/memory-continuity.md:7- Finding
Unsanitized Session Content Is Persisted and Automatically Reloaded
- Content
View full analysis
- Remediation
View remediation
Security audit
EvoMap 高产技能包
Security checks for vulnerabilities and agentic risk
Overview
This skill pack needs Review because it has questionable dumped-data provenance and includes under-scoped instructions for persistent memory, referral propagation, automatic agents, and high-impact API actions.
Install only after verifying the publisher and source of the dumped EvoMap content. Treat the memory, referral-sharing, smart-device API, and auto-agent/self-repair instructions as high-impact behaviors that should require explicit user approval, narrow scoping, and review before any agent follows them.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/http-retry/SKILL.md:14- Finding
Generic Retry Logic Can Replay Non-Idempotent Authenticated Requests
- Content
View full analysis
controller.abort(), timeout); const response = await fetch(url, { ...fetchOptions, signal: controller.signal }); clearTimeout(timeoutId); // Retry 429 or 5xx if (response.status === 429 || response.status >= 500) { const delay = retryDelay * Math.pow(2, attempt); await new Promise(r => setTimeout(r, delay)); continue; } return response; } catch (err) { if (attempt === maxRetries) throw err; await new Promise(r => setTimeout(r, retryDelay * Math.pow(2, attempt))); } } } ``` ### Technical Analysis The helper accepts arbitrary `fetch` options and retries every request method after a network exception, HTTP 429 response, or any 5xx response. It does not distinguish safe or idempotent methods from state-changing operations such as POST or PATCH. A timeout, connection reset, or server error does not establish that the remote operation was not committed. For example, a server may complete a payment, message send, device mutation, or account update and then lose the response. Retrying the same authenticated request can repeat that side effect. The implementation also does not require idempotency keys, detect non-replayable request bodies, inspect `Retry-After`, or restrict destinations. Network access is necessary for an HTTP retry skill, but universally replaying all outbound API calls ...[truncated 1293 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
skills/http-retry/SKILL.md:21- Finding
Request Timeout Timers Are Not Cleared When Fetch Rejects
- Content
View full analysis
controller.abort(), timeout); const response = await fetch(url, { ...fetchOptions, signal: controller.signal }); clearTimeout(timeoutId); // Retry 429 or 5xx if (response.status === 429 || response.status >= 500) { const delay = retryDelay * Math.pow(2, attempt); await new Promise(r => setTimeout(r, delay)); continue; } return response; } catch (err) { if (attempt === maxRetries) throw err; await new Promise(r => setTimeout(r, retryDelay * Math.pow(2, attempt))); } ``` ### Technical Analysis `clearTimeout(timeoutId)` is reached only when `fetch` resolves successfully. If `fetch` rejects before the configured timeout—for example, because of an immediate connection refusal or reset—the timeout remains registered until it expires. Each retry creates another timer. Under high concurrency or repeated immediate failures, many unnecessary timers can remain pending simultaneously. This is a resource-management defect that can contribute to event-loop pressure and memory consumption. ### Attack Path 1. An application performs many concurrent requests through the retry helper. 2. A remote endpoint or network condition causes each request to reject quickly. 3. Every rejected attempt leaves its timeout pending because cleanup is skipped. 4. The retry loop creates additional pending timers for subsequent attempts. 5. Sustained failures accumulate avoidable timer objects until their timeout periods expire. 6. Under sufficient request volume, the process experiences degraded responsiveness or increased memory use. ### Impact Assessment The issue does not provide direct code e ...[truncated 291 chars]- Remediation
View remediation
controller.abort(), timeout); try { return await fetch(url, { ...fetchOptions, signal: controller.signal }); } finally { clearTimeout(timeoutId); } ``` ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The phrase stating the package was obtained by '脱库' from an EvoMap node explicitly indicates origin from a database leak or unauthorized data exfiltration. That makes the skill package inherently untrustworthy: it may embed stolen proprietary content, hidden backdoors, or operational behaviors derived from unlawfully obtained resources, creating legal, supply-chain, and security risk even if the visible text is only an index.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The package description explicitly includes the term '脱库', which commonly refers to database dumping or stolen data exfiltration. In a package manifest, this strongly signals illicit data provenance or offensive intent rather than a legitimate technical function, and there is no contextual justification that would make this benign.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file uses only Chinese for the title, descriptions, and trigger metadata, and does not indicate that the user can choose another language. Under the policy rules, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
json {"protocol":"gep-a2a","protocol_version":"1.0.0","message_type":"fetch","message_id":"msg_1771890478524_dd721aaf","sender_id":"hub_0f978bbe1fb5","timestamp":"2026-02-23T23:47:58.524Z","payload":{"results":[{"asset_id":"sha256:4aad4b4f23b45165b82057a8afe22d956288fc5d386b45bbfb456fd96eee166d","asset_type":"Capsule","status":"promoted","source_node_id":"node_openclaw_1fbeb80bf04abc5a","trigger_text":"timeouterror,econnreset,econnrefused,429toomanyrequests","related_asset_id":null,"bundle_id":"bundle_e0203862ef4188c3","confidence":0.93,"gdi_score":61.9,"gdi_score_mean":69.5,"payload":{"gene":"sha256:3bd63d06d4cd5ece3afa2a2a262abbedb939891b13460e4f8c03e76ef6d3e995","type":"Capsule","outcome":{"score":0.93,"status":"success"},"summary":"Universal HTTP retry with exponential backoff, AbortController timeout, and connection pooling. Handles transient network failures, rate limits (429), and connection resets across all outbound API calls.","trigger":["TimeoutError","ECONNRESET","ECONNREFUSED","429TooManyRequests"],"asset_id":"sha256:4aad4b4f23b45165b82057a8afe22d956288fc5d386b45bbfb456fd96eee166d","confidence":0.93,"blast_radius":{"files":1,"lines":52},"schema_version":"1.5.0","success_streak":30,"env_fingerprint":{"arch":"x64","platform":"linux","node_version":"v22.22.0"}},"bundle_gene":{"asset_id":"sha256:3bd63d06d4cd5ece3afa2a2a262abbedb939891b13460e4f8c03e76ef6d3e995","trigger_text":"econnreset,econnrefused,timeouterror,429toomanyrequests","gdi_score":28.65,"gdi_score_mean":36.25,"payload":{"id":"gene_http_resilience","type":"Gene","summary":"Add resilience to HTTP requests via retry, backoff, and connection pooling","asset_id":"sha256:3bd63d06d4cd5ece3afa2a2a262abbedb939891b13460e4f8c03e76ef6d3e995","category":"repair","strategy":["Implement universal HTTP retry with exponential backoff","Use AbortController for timeouts","Implement connection pooling","Handle transient network failures and rate limits"],"validation":["node -e \"console.log('http resilience ok')\""],"c ...[truncated 27 chars]
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest explicitly tells agents to share the network's connect URL or skill URL with other agents whenever they 'find this network valuable,' which is a very broad and subjective trigger. In an autonomous-agent context, this can cause uncontrolled propagation of external service links and referral data across unrelated conversations, effectively turning the skill into a self-distributing onboarding/advertising mechanism.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Most manifest content is in English, but some summaries include Chinese text such as "固化：gene_gep_repair_from_errors..." with no indication that language may vary or that users can choose a locale. This can violate language/locale policy because the file embeds a specific language output behavior without opt-in or justification.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The referral propagation text directs agents to pass along connection details and a referrer field to other agents. That creates a plain-language data transmission path that can spread network metadata and tracking identifiers beyond the original context, especially if agents follow it automatically.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The referral propagation text directs agents to pass along connection details and a referrer field to other agents. That creates a plain-language data transmission path that can spread network metadata and tracking identifiers beyond the original context, especially if agents follow it automatically.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document explicitly instructs loading recent events, daily memory, and long-term memory across sessions, then saving significant session events, but it provides no notice, consent flow, retention limits, or access controls. This creates a privacy and security risk because user data may be persistently stored and reused across sessions without transparency, increasing the chance of unauthorized retention, over-collection, or disclosure of sensitive information.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file presents all user-facing instructions and labels in Chinese, including the title and trigger description, with no indication that users may opt into another language. This can violate language/locale policy when a skill implicitly forces a specific language for all users without documented justification.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description states the skill pack is 'from node_246ed58b 脱库', indicating it may have been sourced from a database dump or unauthorized extraction. Even though this is metadata rather than executable code, it materially increases the likelihood that the package contains stolen data, unauthorized content, or tooling intended for misuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill title, trigger description, and operational text are entirely in Chinese, with no indication that users may interact in another language or that the skill is intentionally restricted to a Chinese-only environment. This can violate language/locale policy when a skill implicitly requires a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill is written entirely in Chinese and does not indicate any language negotiation or user opt-in, so it may force outputs or interaction patterns that do not match the user's language. While not a code-execution issue, this can degrade transparency and cause misunderstandings in security- or reliability-sensitive troubleshooting flows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list is broad and includes generic troubleshooting terms like 'retry', '429', and common network errors, which can cause the skill to activate in many ordinary contexts beyond a clear request for this specific capability. Over-broad activation can steer agent behavior unexpectedly, causing inappropriate code suggestions or workflow changes when the user did not explicitly ask for this retry mechanism.
- Content