Security audit

logos-node

Security checks across malware telemetry and agentic risk

Overview

This skill performs disclosed Logos testnet node operations, but users should treat updates and installer scripts carefully because they can delete node state and install files into AI-agent skill directories.

Install this only on a Linux x86_64 server you intend to use for a Logos testnet node. Prefer the ClawHub or package-manager install path over curl-to-bash, verify release assets before running downloaded binaries, and back up or record any needed wallet/config information before using the breaking update flow because it deletes local node state and configuration.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The installer enumerates multiple unrelated AI-agent environments and uses local indicators such as agent config directories, git remotes, and API-key presence to decide where to copy files. For a skill described as managing a Logos validator node, this broad environment discovery is not necessary and expands the script's access to unrelated tooling, increasing the chance of unexpected persistence or user confusion.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script functions primarily as a generic cross-agent bootstrapper that downloads a remote archive and installs skill files into agent-specific directories, rather than performing Logos node installation or operation. This mismatch between stated purpose and actual behavior makes the script riskier because users expecting node setup may instead grant broad installation into assistant environments.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README explicitly says the update flow will 'wipe state' during a breaking upgrade, but it does not warn users that this is destructive or potentially irreversible. In an agent skill context, users may follow commands with elevated privileges and lose validator data, local state, or configuration without understanding the consequences.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The update procedure instructs deletion of state and config paths as part of a breaking upgrade, but it does not prominently require explicit user confirmation or a backup warning before destructive actions. In an operational skill, this creates a real risk of accidental data loss, loss of local configuration, or operator error during maintenance.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The installer fetches a remote tarball and immediately unpacks and installs its contents into agent skill directories without integrity verification or a prominent warning about what files will be written. This creates a supply-chain risk: if the remote branch is changed or compromised, users may silently install attacker-controlled content into trusted assistant locations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The update workflow explicitly instructs deletion of node state, config, and circuits without requiring an explicit confirmation step, backup, or warning about irreversible data loss. In an agent setting, this increases the chance of accidental destructive execution, especially if the user asks for a routine update and does not realize it performs a full reset.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The procedure states that a wallet key is printed and saved, but it does not clearly warn that this key is sensitive secret material whose disclosure can lead to loss of control over funds or validator identity. In the context of a blockchain node setup guide, operators may copy, log, or share terminal output during troubleshooting, increasing the chance of accidental credential exposure.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill instructs operators to delete `/pool0/logos/state`, `/pool0/logos/user_config.yaml`, and `/pool0/logos/.logos-blockchain-circuits` during a breaking update, but does not explicitly warn that this is destructive, irreversible, and may remove local chain state or custom configuration. In an automation or copy-paste workflow, this increases the chance of accidental data loss and service disruption, especially because the guidance is presented as a required operational rule.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The procedure instructs operators to delete node state, configuration, and circuits, which is inherently destructive and can permanently remove wallet/config data. Although this may be operationally necessary for a breaking chain reset, the document does not give an explicit data-loss warning immediately before the deletion commands or require backup/confirmation, making accidental irreversible loss more likely.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.