Security audit

GEP Immune Auditor

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its security-audit purpose, but its helper can publish audit-derived data externally without enforcing the promised per-publish confirmation.

Review before installing or using this skill in sensitive environments. Use dry-run unless you intentionally want to publish, verify exactly what summaries and signals will be sent, and only set A2A_HUB_URL to a trusted EvoMap endpoint. Do not let automation invoke the publisher without an explicit approval step.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: evomap_publish.py:105
Finding: Outbound publication occurs without enforced user confirmation
Content: View full analysis
dict: envelope = make_envelope("publish", {"assets": assets}) if dry_run: print("=== DRY RUN ===") print(json.dumps(envelope, indent=2, ensure_ascii=False)) return {"status": "dry_run"} # 用 curl 发送，绕过 Cloudflare 对 Python urllib 的 bot 检测 payload_json = json.dumps(envelope, ensure_ascii=False) result = subprocess.run( ["curl", "-s", "-X", "POST", f"{HUB_URL}/a2a/publish", "-H", "Content-Type: application/json", "-d", payload_json], capture_output=True, text=True, timeout=30, ) ``` The main execution path calls the function directly, with no confirmation or authorization check: ```python publish(assets, dry_run=args.dry_run) ``` ### Technical Analysis The documented security model requires affirmative user consent before data is published to an external service. The implementation does not enforce that requirement. Instead, publication is the default, while `--dry-run` is an optional caller-controlled safety mechanism. This is a fail-open design: an automated agent, integration, or accidental command invocation can ...[truncated 1428 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: evomap_publish.py:20
Finding: Unvalidated environment-controlled publication endpoint enables data redirection and internal requests
Content: View full analysis
str: with open(NODE_CONFIG) as f: return json.load(f)["sender_id"] def canonical_json(obj: dict) -> str: return json.dumps(obj, sort_keys=True, separators=(",", ":"), ensure_ascii=False) def compute_asset_id(asset: dict) -> str: clean = {k: v for k, v in asset.items() if k != "asset_id"} h = hashlib.sha256(canonical_json(clean).encode("utf-8")).hexdigest() return f"sha256:{h}" def make_envelope(message_type: str, payload: dict) -> dict: sender_id = load_sender_id() return { "protocol": "gep-a2a", "protocol_version": "1.0.0", "message_type": message_type, "message_id": f"msg_{int(time.time())}_{os.urandom(4).hex()}", "sender_id": sender_id, "timestamp": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), "payload": payload, } ``` The unvalidated value is subsequently used as the request destination: ```python def publish(assets: list, dry_run: bool = False) -> dict: envelope = make_envelope("publish", {"assets": assets}) if dry_run: print("=== DRY RUN ===") print(json.dumps(envelope, indent=2, ensure_ascii=False)) return {"status": "dry_run"} # 用 curl 发送，绕过 Cloudflare 对 Python urllib 的 bot 检测 payload_json = json.dumps(envelope, ensure_ascii=False) result = subprocess.run( ["curl", "-s", "-X", "POST", f"{HUB_URL}/a2a/publish", "-H", "Content-Type: application/json", "-d", payload_json], capture_output=True, text=True, timeout=30, ...[truncated 2046 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding describes a substantial mismatch between the skill's stated purpose and its actual behavior: it claims to audit assets, but instead performs undeclared outbound publishing and local file access while lacking the promised detection logic. That combination is dangerous because it can mislead users into supplying untrusted or sensitive inputs to a tool that may exfiltrate data or mutate ecosystem state under the guise of security analysis.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill metadata declares required binaries and environment access but does not explicitly scope or constrain tool permissions, making the effective capabilities broader and less auditable than they appear. In a security-auditor skill, implicit access to shell, network, and environment data is risky because users may trust it with sensitive assets and assume it only performs passive analysis.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This audit skill includes active network publication behavior, which materially expands its capabilities beyond local analysis into external data transfer. In a security-auditing context, that increases risk because findings, metadata, and potentially sensitive summaries can leave the local environment and create an unexpected outbound channel.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script publishes audit-derived content to a remote service without any interactive confirmation, warning, or consent checkpoint. In security review workflows, audit summaries and signals may contain sensitive internal information, so silent transmission creates a meaningful exfiltration and privacy risk.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · evomap_publish.py (reported line 110)May include surrounding context.
python
# 用 curl 发送，绕过 Cloudflare 对 Python urllib 的 bot 检测 payload_json = json.dumps(envelope, ensure_ascii=False) result = subprocess.run( ["curl", "-s", "-X", "POST", f"{HUB_URL}/a2a/publish", "-H", "Content-Type: application/json", "-d", payload_json],

Tainted flow: 'HUB_URL' from os.environ.get (line 21, credential/environment) → subprocess.run (code execution)

Medium

Category: Data Flow
Confidence: 92% confidence
Finding: The destination URL is taken from the A2A_HUB_URL environment variable and used to send data externally without validation or allowlisting. An attacker who can influence the environment can redirect audit outputs to an arbitrary host, causing exfiltration of audit artifacts and trust abuse in a security-sensitive workflow.
Content: Scanner excerpt · evomap_publish.py (reported line 110)May include surrounding context.
python
# 用 curl 发送，绕过 Cloudflare 对 Python urllib 的 bot 检测 payload_json = json.dumps(envelope, ensure_ascii=False) result = subprocess.run( ["curl", "-s", "-X", "POST", f"{HUB_URL}/a2a/publish", "-H", "Content-Type: application/json", "-d", payload_json],

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring, CLI usage text, and help descriptions are all presented in Chinese, which imposes a specific language on users without any opt-in or alternative. Under the policy, forcing a language or locale without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.