logos-node

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 1.0.0

Overview

This appears to be a real Logos node helper, but it needs review because it can run privileged setup commands, install persistent services, fetch unverified code from live GitHub sources, and delete node configuration during updates.

Install only on a dedicated testnet host where privileged node changes are acceptable. Avoid the curl-to-bash path, prefer a pinned reviewed commit or release, verify checksums or signatures for the skill and Logos binaries, review every command before running it, and back up /pool0/logos/user_config.yaml and any recoverable state before using update.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:9

Finding

Mutable Remote Installer Is Executed Directly by the Shell

Content

View full analysis

Remediation

View remediation

install.sh' | sha256sum -c - less install.sh bash install.sh ``` 4. Pin `TARBALL` to a full commit SHA rather than the mutable `logos-node` branch. 5. Publish the expected archive digest through a separately protected release channel and verify it before extraction. 6. Use signed release artifacts, such as Sigstore/cosign attestations or GPG signatures. 7. Display the exact commit and digest being installed. 8. Fail closed when verification cannot be completed. 9. Avoid installing into multiple detected agent directories without explicit, per-target user consent. ]]>

T08 · Insecure Dependencies

Error

• Location: skill/install-procedure.md:43

Finding

Downloaded Node Executables Are Neither Signature nor Checksum Verified

Content

View full analysis

" tar -xf logos-blockchain-node.tar.gz # ZK circuits curl -L -o logos-blockchain-circuits.tar.gz "" tar -xf logos-blockchain-circuits.tar.gz rm -rf /pool0/logos/.logos-blockchain-circuits mv /pool0/logos/logos-blockchain-circuits-* /pool0/logos/.logos-blockchain-circuits ' ``` The downloaded binary is only executed with `--version`: ```bash su - logos -c '/pool0/logos/logos-blockchain-node --version' ``` The update procedure similarly overwrites the live binary without cryptographic verification: ```bash curl -L -o logos-blockchain-node-new.tar.gz "" tar -xf logos-blockchain-node-new.tar.gz # the binary will overwrite the old one in-place ``` ### Technical Analysis Binary and circuit asset URLs are selected from live GitHub release metadata, downloaded, extracted, and executed without validating a trusted checksum or signature. Running the binary with `--version` is not an integrity check: a malicious executable can print the expected version while performing arbitrary actions. The update process extracts an archive directly into the live node directory and permits the new archive to overwrite the existing executable in place. The resulting executable is subsequently started by systemd: ```ini User=logos Group=logos ExecStart=/pool0/logos/logos-blockchain-node /pool0/logos/user_config.yaml Restart=on-failure ``` Although the service correctly runs as the dedicated `logos` user and enables `NoNewPrivileges`, it is configured to restart and is enabled at boot. Consequently, a compromised release artifact ...[truncated 1280 chars]

Remediation

View remediation

/logos-blockchain-node`, rather than overwriting the live binary in place. 7. Atomically change a controlled symlink only after verification and successful validation. 8. Retain the previous verified binary to support rollback. 9. Fail closed if checksums, signatures, expected filenames, architecture, or publisher identity cannot be verified. 10. Further harden the systemd service with appropriate directives such as `ProtectSystem=strict`, `ProtectHome=true`, `PrivateDevices=true`, `RestrictSUIDSGID=true`, and narrowly scoped `ReadWritePaths=/pool0/logos`, after compatibility testing. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: skill/SKILL.md:36

Finding

Untrusted Release Notes and Remote Documentation Are Treated as Agent Instructions

Content

View full analysis

/dev/null` ``` From the response extract: - `tag` — stable version (e.g. `0.1.2`) — **ignore any tag containing `-rc`, `-dev`, or `-beta`** - `assets[].url` — filter for `linux-x86_64` binary tarball and circuits tarball - `body` — breaking-change notice and bootstrap peers If the API call fails or returns no stable release, fall back to the official quickstart docs: ``` !`curl -s https://raw.githubusercontent.com/logos-co/logos-docs/main/docs/blockchain/quickstart-guide-for-the-logos-blockchain-node.md | head -120` ``` ``` ### Technical Analysis The Skill requires the agent to ingest mutable, externally controlled release text and documentation before every operation. The output is not treated strictly as untrusted data. In particular, the agent is instructed to interpret the release body for operational decisions and extract bootstrap-peer values that are later incorporated into commands. This creates an indirect prompt-injection boundary. Release notes or fallback documentation can contain text crafted to resemble authoritative Skill instructions, such as reque ...[truncated 1823 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skill/update-procedure.md:62

Finding

Breaking Update Irreversibly Deletes Node State and Wallet Configuration Without Backup or Confirmation

Content

View full analysis

Remediation

View remediation

chmod 0600 /pool0/logos/backups/user_config.yaml. ``` 3. Snapshot or rename the existing state and circuits instead of deleting them immediately. 4. Download and cryptographically verify all replacement artifacts before stopping the service or modifying existing files. 5. Determine whether an update is breaking using signed, machine-readable metadata rather than free-form release prose. 6. Validate that each deletion target resolves beneath `/pool0/logos` and is not an unexpected mount point. 7. Implement an automatic rollback if initialization or service health checks fail. 8. Delete backups only after the new node reaches the expected healthy state and the operator separately confirms cleanup. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (40)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md

| Command | Action |
|---|---|
| `/logos-node install` | Fresh node installation: binary, circuits, systemd service, faucet |
| `/logos-node update` | Breaking upgrade: wipe state, re-init, restart with new binary |
| `/logos-node status` | Check sync mode, peers, block height, wallet balance |

---

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

| Command | Action |
|---|---|
| `/logos-node install` | Fresh node installation: binary, circuits, systemd service, faucet |
| `/logos-node update` | Breaking upgrade: wipe state, re-init, restart with new binary |
| `/logos-node status` | Check sync mode, peers, block height, wallet balance |

---

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · skill/SKILL.md (reported line 29)May include surrounding context.

md

| Command | Action |
|---|---|
| `/logos-node install` | Fresh node installation: binary, circuits, systemd service, faucet |
| `/logos-node update` | Breaking upgrade: wipe state, re-init, restart with new binary |
| `/logos-node status` | Check sync mode, peers, block height, wallet balance |

---

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | bash construct chains network retrieval directly into shell execution, eliminating validation boundaries and amplifying the impact of any compromise in the fetched content. Because this skill is used for validator-node setup and may be run with elevated privileges, this pattern materially increases the likelihood of remote code execution on operator infrastructure.

Content

Scanner excerpt · README.md (reported line 68)May include surrounding context.

Option 5 — Bash (no npm)

bash

curl -fsSL https://raw.githubusercontent.com/citizenweb3/ai-integrations/logos-node/install.sh | bash

---

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose says this skill installs, updates, or checks the status of a Logos Blockchain testnet validator node on Linux. However, the supplied shell script does not perform node lifecycle management at all. Its primary purpose is bootstrapping the skill package itself into supported AI assistant directories. While it prints suggested '/logos-node install|update|status' commands, those node-related actions are not implemented in this code chunk. This is a material description/behavior mismatch because the actual code handles AI skill deployment rather than blockchain node setup or maintenance.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Piping remotely fetched content directly into bash removes any inspection or integrity-verification step and turns a repository compromise or man-in-the-middle event into immediate code execution. This is especially dangerous for an installer that writes into AI-agent skill directories, because a successful compromise can establish lasting influence over future agent behavior.

Content

Scanner excerpt · install.sh (reported line 3)May include surrounding context.

sh

#!/usr/bin/env bash
# install.sh — Logos Node skill installer (no npm required)
# Usage: curl -fsSL https://raw.githubusercontent.com/citizenweb3/ai-integrations/logos-node/install.sh | bash
set -euo pipefail

REPO="citizenweb3/ai-integrations"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skill/install-procedure.md (reported line 54)May include surrounding context.

ZK circuits

curl -L -o logos-blockchain-circuits.tar.gz "<CIRCUITS_URL_FROM_RELEASE>" tar -xf logos-blockchain-circuits.tar.gz rm -rf /pool0/logos/.logos-blockchain-circuits mv /pool0/logos/logos-blockchain-circuits-* /pool0/logos/.logos-blockchain-circuits '

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skill/install-procedure.md (reported line 54)May include surrounding context.

ZK circuits

curl -L -o logos-blockchain-circuits.tar.gz "<CIRCUITS_URL_FROM_RELEASE>" tar -xf logos-blockchain-circuits.tar.gz rm -rf /pool0/logos/.logos-blockchain-circuits mv /pool0/logos/logos-blockchain-circuits-* /pool0/logos/.logos-blockchain-circuits '

text

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · skill/status-checks.md (reported line 34)May include surrounding context.

Consensus info

bash

curl -s http://localhost:8080/cryptarchia/info | python3 -m json.tool

Fields to check:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · skill/status-checks.md (reported line 51)May include surrounding context.

Peer connectivity

bash

curl -s http://localhost:8080/network/info | python3 -m json.tool

Fields to check:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · skill/status-checks.md (reported line 79)May include surrounding context.

Check balance (replace <key> with the hex string from config):

bash

curl -s http://localhost:8080/wallet/<key>/balance | python3 -m json.tool

Expected response:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

Although the matched text resembles a generic rm -rf pattern, the actual command still represents a true hazardous instruction because it deletes node state irreversibly. The skill context makes it somewhat justified for a breaking reinitialization, but still dangerous because operators are directed to execute destructive shell commands manually.

Content

Scanner excerpt · skill/update-procedure.md (reported line 67)May include surrounding context.

All three paths must be removed. Skipping any one causes genesis mismatch errors.

bash

rm -rf /pool0/logos/state
rm -f  /pool0/logos/user_config.yaml
rm -rf /pool0/logos/.logos-blockchain-circuits

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

Although the matched text resembles a generic rm -rf pattern, the actual command still represents a true hazardous instruction because it deletes node state irreversibly. The skill context makes it somewhat justified for a breaking reinitialization, but still dangerous because operators are directed to execute destructive shell commands manually.

Content

Scanner excerpt · skill/update-procedure.md (reported line 67)May include surrounding context.

All three paths must be removed. Skipping any one causes genesis mismatch errors.

bash

rm -rf /pool0/logos/state
rm -f  /pool0/logos/user_config.yaml
rm -rf /pool0/logos/.logos-blockchain-circuits

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

Deleting user_config.yaml can destroy configuration and likely wallet/key material for the node, causing loss of local identity and requiring a new wallet initialization. Because the procedure only later mentions that the old wallet key is gone, an operator may not appreciate the severity before running the command.

Content

Scanner excerpt · skill/update-procedure.md (reported line 68)May include surrounding context.

bash

rm -rf /pool0/logos/state
rm -f  /pool0/logos/user_config.yaml
rm -rf /pool0/logos/.logos-blockchain-circuits

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This finding is a true positive because the command forcefully removes a hidden application directory recursively, which can have significant destructive impact if copied incorrectly or applied to the wrong host. The skill context is a validator-node upgrade guide, so such commands are operationally relevant, but that context does not eliminate the need for strong warnings and validation.

Content

Scanner excerpt · skill/update-procedure.md (reported line 69)May include surrounding context.

bash

rm -rf /pool0/logos/state
rm -f  /pool0/logos/user_config.yaml
rm -rf /pool0/logos/.logos-blockchain-circuits

Verify all are gone:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This finding is a true positive because the command forcefully removes a hidden application directory recursively, which can have significant destructive impact if copied incorrectly or applied to the wrong host. The skill context is a validator-node upgrade guide, so such commands are operationally relevant, but that context does not eliminate the need for strong warnings and validation.

Content

Scanner excerpt · skill/update-procedure.md (reported line 69)May include surrounding context.

bash

rm -rf /pool0/logos/state
rm -f  /pool0/logos/user_config.yaml
rm -rf /pool0/logos/.logos-blockchain-circuits

Verify all are gone:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README states that /logos-node update performs a breaking upgrade that will 'wipe state' but does not provide a prominent warning about data loss, downtime, re-sync cost, or the need to verify backups before proceeding. In operational infrastructure, unclear destructive behavior can lead to accidental service disruption even if the action is intended.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

md

- `glibc ≥ 2.39` (Ubuntu 24.04+, Debian 12+)
- `≥ 64 GB` free storage
- `curl`, `tar`, `systemctl` on the server
- Root or sudo access for systemd setup

---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

Using npx @citizenweb3/ai-integrations without a pinned version causes runtime retrieval of whatever package version is current at execution time. If the upstream package is compromised, replaced, or publishes a breaking/malicious release, users may execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The global install example again invokes npx @citizenweb3/ai-integrations without a fixed version, which makes the executed code depend on the latest published package at runtime. In a skill that helps install validator infrastructure, this increases supply-chain risk because users may run privileged setup steps based on an unpinned package.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

npx clawhub@latest install citizenweb3/logos-node explicitly tracks the latest release, which has the same trust-on-first-use and supply-chain exposure as an unpinned dependency. If the package or publishing account is compromised, users can fetch and run attacker-controlled code.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The skill pulls release metadata from the GitHub API and then uses that information to select binaries and bootstrap peers. This creates a trust dependency on external network content that could be unavailable, tampered with upstream, or manipulated if the repository/account is compromised, potentially leading to installation of unsafe artifacts or use of malicious peers.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

may be an RC; instead fetch the full list and pick the first non-prerelease entry:

text

!`curl -s https://api.github.com/repos/logos-blockchain/logos-blockchain/releases | python3 -c "import sys,json; releases=[r for r in json.load(sys.stdin) if not r['prerelease'] and not r['draft']]; r=releases[0]; print(json.dumps({'tag':r['tag_name'],'assets':[{'name':a['name'],'url':a['browser_download_url']} for a in r['assets']],'body':r['body'][:2000]}))" 2>/dev/null`

From the response extract:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The update procedure explicitly instructs deletion of node state, config, and circuits as part of a breaking upgrade, but the skill does not require a clear pre-deletion confirmation or prominently warn about irreversible data loss. In an agent-executed context, this increases the chance of accidental destructive action against a live node or mis-targeted host path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The usage example encourages piping a remotely fetched script directly to bash, and the script also downloads a tarball from GitHub during execution. While progress messages mention downloading, there is no explicit warning to users that code and installation payloads are being retrieved from the network and trusted for local installation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The installer enumerates multiple unrelated AI-agent environments and checks for sensitive-environment indicators such as API-key presence to decide installation targets. While not directly exfiltrating secrets, this broad probing exceeds what is necessary for a Logos node skill and increases privacy and attack surface concerns by adapting behavior based on unrelated tooling present on the host.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.