GEP Immune Auditor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:58 PM UTC
• Version: 1.0.1

Overview

The skill mostly matches its security-audit purpose, but its helper can publish audit-derived data externally without enforcing the promised per-publish confirmation.

Review before installing or using this skill in sensitive environments. Use dry-run unless you intentionally want to publish, verify exactly what summaries and signals will be sent, and only set A2A_HUB_URL to a trusted EvoMap endpoint. Do not let automation invoke the publisher without an explicit approval step.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: evomap_publish.py:105
• Finding: Outbound publication occurs without enforced user confirmation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:136-140`; `evomap_publish.py:105-130, 171` **Vulnerability Type**: Missing authorization and confirmation control for external publication **Risk Level**: Medium ### Evidence The documentation explicitly requires confirmation before each publication: ```markdown When findings are 🟠 THREAT or higher, the auditor can publish the discovered malicious pattern to EvoMap as a Gene+Capsule bundle, making the detection rule available to all connected agents. This requires: - `A2A_HUB_URL` environment variable (default: `https://evomap.ai`) - A registered EvoMap node (sender_id stored locally) - User confirmation before each publish ``` However, the publishing function transmits the assets unless the caller voluntarily enables dry-run mode: ```python def publish(assets: list, dry_run: bool = False) -> dict: envelope = make_envelope("publish", {"assets": assets}) if dry_run: print("=== DRY RUN ===") print(json.dumps(envelope, indent=2, ensure_ascii=False)) return {"status": "dry_run"} # 用 curl 发送，绕过 Cloudflare 对 Python urllib 的 bot 检测 payload_json = json.dumps(envelope, ensure_ascii=False) result = subprocess.run( ["curl", "-s", "-X", "POST", f"{HUB_URL}/a2a/publish", "-H", "Content-Type: application/json", "-d", payload_json], capture_output=True, text=True, timeout=30, ) ``` The main execution path calls the function directly, with no confirmation or authorization check: ```python publish(assets, dry_run=args.dry_run) ``` ### Technical Analysis The documented security model requires affirmative user consent before data is published to an external service. The implementation does not enforce that requirement. Instead, publication is the default, while `--dry-run` is an optional caller-controlled safety mechanism. This is a fail-open design: an automated agent, integration, or accidental command invocation can ...[truncated 1428 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make dry-run behavior the default. 2. Require a distinct explicit flag such as `--confirm-publish` before any network transmission. 3. In interactive use, display the complete destination and redacted payload, then require affirmative confirmation. 4. In non-interactive use, reject publication unless a separately provisioned authorization mechanism is present. 5. Ensure consent applies to the exact payload shown to the user so that the payload cannot change between review and transmission. 6. Add automated tests proving that an invocation without explicit approval performs no outbound request. 7. Redact or reject secrets, credentials, local paths, and other sensitive content before constructing the publication envelope. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: evomap_publish.py:20
• Finding: Unvalidated environment-controlled publication endpoint enables data redirection and internal requests<![CDATA[ ## Vulnerability Details **File Location**: `evomap_publish.py:20, 31-50, 105-118` **Vulnerability Type**: Unvalidated outbound request destination **Risk Level**: Medium ### Evidence The destination is read directly from an environment variable without scheme or host validation: ```python HUB_URL = os.environ.get("A2A_HUB_URL", "https://evomap.ai") ``` The envelope includes the locally stored sender identity: ```python def load_sender_id() -> str: with open(NODE_CONFIG) as f: return json.load(f)["sender_id"] def canonical_json(obj: dict) -> str: return json.dumps(obj, sort_keys=True, separators=(",", ":"), ensure_ascii=False) def compute_asset_id(asset: dict) -> str: clean = {k: v for k, v in asset.items() if k != "asset_id"} h = hashlib.sha256(canonical_json(clean).encode("utf-8")).hexdigest() return f"sha256:{h}" def make_envelope(message_type: str, payload: dict) -> dict: sender_id = load_sender_id() return { "protocol": "gep-a2a", "protocol_version": "1.0.0", "message_type": message_type, "message_id": f"msg_{int(time.time())}_{os.urandom(4).hex()}", "sender_id": sender_id, "timestamp": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), "payload": payload, } ``` The unvalidated value is subsequently used as the request destination: ```python def publish(assets: list, dry_run: bool = False) -> dict: envelope = make_envelope("publish", {"assets": assets}) if dry_run: print("=== DRY RUN ===") print(json.dumps(envelope, indent=2, ensure_ascii=False)) return {"status": "dry_run"} # 用 curl 发送，绕过 Cloudflare 对 Python urllib 的 bot 检测 payload_json = json.dumps(envelope, ensure_ascii=False) result = subprocess.run( ["curl", "-s", "-X", "POST", f"{HUB_URL}/a2a/publish", "-H", "Content-Type: application/json", "-d", payload_json], capture_output=True, text=True, timeout=30, ...[truncated 2046 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse the destination with a standard URL parser before use. 2. Require the `https` scheme for production publication. 3. Maintain an explicit allowlist of trusted hostnames, such as the intended EvoMap service. 4. Reject URLs containing embedded credentials, fragments, unexpected ports, or unsupported schemes. 5. Resolve and reject loopback, link-local, private, multicast, and otherwise prohibited address ranges unless a separately approved private deployment explicitly requires them. 6. Treat custom endpoints as an exceptional configuration requiring explicit user approval. 7. Log the validated destination before sending, without exposing sensitive payload fields. 8. Combine endpoint validation with the mandatory publication-confirmation control described in the preceding finding. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The finding describes a substantial mismatch between the skill's stated purpose and its actual behavior: it claims to audit assets, but instead performs undeclared outbound publishing and local file access while lacking the promised detection logic. That combination is dangerous because it can mislead users into supplying untrusted or sensitive inputs to a tool that may exfiltrate data or mutate ecosystem state under the guise of security analysis.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill metadata declares required binaries and environment access but does not explicitly scope or constrain tool permissions, making the effective capabilities broader and less auditable than they appear. In a security-auditor skill, implicit access to shell, network, and environment data is risky because users may trust it with sensitive assets and assume it only performs passive analysis.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This audit skill includes active network publication behavior, which materially expands its capabilities beyond local analysis into external data transfer. In a security-auditing context, that increases risk because findings, metadata, and potentially sensitive summaries can leave the local environment and create an unexpected outbound channel.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script publishes audit-derived content to a remote service without any interactive confirmation, warning, or consent checkpoint. In security review workflows, audit summaries and signals may contain sensitive internal information, so silent transmission creates a meaningful exfiltration and privacy risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 用 curl 发送，绕过 Cloudflare 对 Python urllib 的 bot 检测
    payload_json = json.dumps(envelope, ensure_ascii=False)
    result = subprocess.run(
        ["curl", "-s", "-X", "POST", f"{HUB_URL}/a2a/publish",
         "-H", "Content-Type: application/json",
         "-d", payload_json],

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Tainted flow: 'HUB_URL' from os.environ.get (line 21, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

# 用 curl 发送，绕过 Cloudflare 对 Python urllib 的 bot 检测
    payload_json = json.dumps(envelope, ensure_ascii=False)
    result = subprocess.run(
        ["curl", "-s", "-X", "POST", f"{HUB_URL}/a2a/publish",
         "-H", "Content-Type: application/json",
         "-d", payload_json],

• Confidence: 92% confidence
• Finding: The destination URL is taken from the A2A_HUB_URL environment variable and used to send data externally without validation or allowlisting. An attacker who can influence the environment can redirect audit outputs to an arbitrary host, causing exfiltration of audit artifacts and trust abuse in a security-sensitive workflow.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The module docstring, CLI usage text, and help descriptions are all presented in Chinese, which imposes a specific language on users without any opt-in or alternative. Under the policy, forcing a language or locale without user choice is a natural-language policy concern.

Static analysis

No suspicious patterns detected.