PinkyBrain

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:20 AM UTC
• Version: 5.3.3

Overview

This skill describes a legitimate P2P AI mesh, but installation and update instructions rely on mutable external code and the mesh features expose local resources, network metadata, and stored conversations in ways users should review carefully.

Install only if you are comfortable running a networked background AI node from the publisher's live GitHub repository. Prefer a pinned commit or signed release, review the upstream code and dependencies, keep the node local/private until configured, avoid sensitive prompts until retention and privacy settings are understood, and disable public mesh, auto-discovery, model sharing, and update application unless you explicitly need them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:38
• Finding: Unpinned External Repository and Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:38-44` **Additional Location**: `README.md:54-57`, `SKILL.md:334-335` **Vulnerability Type**: Supply-chain exposure through mutable, unpinned external code **Risk Level**: High **Vulnerable Code**: ```bash # Clone the PinkyBrain repository git clone https://github.com/PinkyBrain-ai/pinkybrain.git ~/pinkybrain cd ~/pinkybrain # Create virtual environment and install dependencies python3 -m venv .venv source .venv/bin/activate pip install -r requirements.txt ``` ### Technical Analysis The installation procedure clones the current default branch of an external repository without pinning a reviewed commit, signed tag, or release artifact. It then installs dependencies from a `requirements.txt` file that is not included in the audited artifact. Consequently, the code and dependency graph executed by a user may differ from what existed when this Skill was reviewed. No lockfile, package hashes, trusted package index restrictions, or integrity verification instructions are supplied. The two audited documentation files cannot establish whether the external repository's setup process or transitive dependencies are safe. This creates a supply-chain execution channel. A compromised repository, malicious maintainer update, dependency takeover, dependency-confusion package, or compromised package-index account could introduce executable code. ### Attack Path 1. An attacker compromises the external repository, one of its maintainers, or a dependency referenced by its requirements. 2. The attacker adds malicious runtime or installation code to the default branch or dependency package. 3. A user follows the documented `git clone` and `pip install -r requirements.txt` procedure. 4. Malicious dependency installation hooks may execute during installation, or malicious application code executes when the node is initialized or started. 5. The payload operates with the priv ...[truncated 710 chars]
• Remediation: ## Remediation Suggestions 1. Pin the repository to a reviewed, immutable commit hash or cryptographically signed release tag. 2. Publish and verify release artifacts with a documented signing key and trusted fingerprint. 3. Include a dependency lockfile containing exact versions and cryptographic hashes. 4. Install Python packages with hash enforcement, such as `pip install --require-hashes`. 5. Restrict installation to explicitly approved package indexes and disable unintended fallback indexes. 6. Audit all direct and transitive dependencies and automate vulnerability and provenance checks. 7. Include the executable source or a verifiable source manifest in the Skill package so reviewers can assess the actual implementation. 8. Run the node under a dedicated, unprivileged operating-system account with restricted filesystem and network access.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:207
• Finding: Remote Update Retrieval and Application Without Auditable Trust Configuration## Vulnerability Details **File Location**: `SKILL.md:207-211` **Vulnerability Type**: Post-review retrieval and execution of mutable remote code **Risk Level**: High **Vulnerable Code**: ```bash ### Updates # Check for PinkyBrain updates pinkybrain update check # → GET /api/update # Apply updates pinkybrain update apply # Downloads verified update (SHA-256 + Ed25519 signature check) ``` ### Technical Analysis The Skill instructs users to invoke an updater that downloads and applies external updates. Although the comment claims SHA-256 and Ed25519 verification, the audited artifact contains no updater implementation, trusted public key, key fingerprint, update-source allowlist, signed manifest format, version policy, or rollback protection. A SHA-256 digest alone does not establish authenticity if an attacker can modify both the payload and its published digest. Ed25519 verification can provide authenticity only if the verifier securely pins the correct trusted key and protects key rotation. Those controls cannot be verified from the supplied files. The updater allows the effective application payload to change after the Skill has been reviewed. It therefore forms a remote payload retrieval and execution channel whose security depends entirely on unavailable external implementation and infrastructure. ### Attack Path 1. An attacker compromises the update server, distribution channel, DNS or transport path, updater implementation, or trusted signing key. 2. The attacker supplies a malicious update and any metadata accepted by the updater. 3. A user invokes `pinkybrain update apply`. 4. If trust validation is absent, incorrectly implemented, or based on a compromised key, the update is accepted and installed. 5. The malicious replacement executes when the node restarts or when the update mechanism activates it. ### Impact Assessment Exploitation could replace the PinkyBrain executabl ...[truncated 574 chars]
• Remediation: ## Remediation Suggestions 1. Pin a dedicated update-signing public key in the client and publish its fingerprint through an independent trusted channel. 2. Require signed update manifests that bind the version, artifact hash, size, platform, and release metadata. 3. Restrict downloads to an explicit HTTPS origin and reject redirects to unapproved hosts. 4. Add expiration checks, monotonic version enforcement, and rollback protection. 5. Verify signatures before extracting or executing any downloaded content. 6. Stage updates in a non-executable location and reject archives containing path traversal, links, or unexpected files. 7. Require explicit user confirmation that displays the source, version, signer, and digest. 8. Publish the updater implementation and trust-root configuration as part of the auditable artifact. 9. Run update operations with the minimum permissions required and provide a verified rollback procedure.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:68
• Finding: Automatic VPN Configuration Inspection and Local Network Discovery## Vulnerability Details **File Location**: `SKILL.md:68-75` **Additional Location**: `README.md:118-125` **Vulnerability Type**: Network reconnaissance and access beyond a fixed local endpoint **Risk Level**: Medium **Vulnerable Code**: ```text ## Auto-Discovery When the skill needs to find a running PinkyBrain node, it checks in order: 1. **`PINKYBRAIN_URL`** environment variable (e.g. `http://my-node:8080`) 2. **`http://localhost:8080/api/ping`** — default port 3. **`http://localhost:8081/api/ping`** — alternate port 4. **Tailscale peers** — reads Tailscale config for peers running PinkyBrain 5. **mDNS discovery** — `_pinkybrain._tcp.local.` service discovery ``` ### Technical Analysis The documented auto-discovery process goes beyond checking explicitly configured and localhost endpoints. It reads Tailscale configuration to identify VPN peers and performs mDNS discovery on the local network. Peer enumeration is consistent with the declared P2P purpose, and the audited files do not demonstrate exfiltration or privilege-bypass code. Nevertheless, automatic inspection of VPN topology and LAN services exposes potentially sensitive network metadata to externally installed code and expands the connection scope beyond endpoints individually selected by the user. Because the implementation is not included, the audit cannot verify which Tailscale files, commands, APIs, or credentials are accessed; whether discovered results are transmitted to the tracker; or whether peer identities and endpoint responses are authenticated before subsequent use. ### Attack Path 1. The user invokes a command without an explicit URL, triggering auto-discovery. 2. The installed client reads available Tailscale peer information and broadcasts or listens for mDNS discovery data. 3. A malicious local service may advertise the expected mDNS service, or a compromised upstream client may collect the discovered VPN and LAN topology. 4. T ...[truncated 818 chars]
• Remediation: ## Remediation Suggestions 1. Disable Tailscale and mDNS discovery by default and require explicit, informed opt-in for each mechanism. 2. Prefer an explicitly configured endpoint and display discovered endpoints before connecting. 3. Document exactly which Tailscale configuration files, commands, or APIs are accessed. 4. Read only the minimum non-secret metadata required for discovery. 5. Never transmit discovered VPN or LAN topology to a tracker or remote peer without separate consent. 6. Authenticate every discovered endpoint using a pinned identity or an explicitly trusted Web-of-Trust path before sending queries or data. 7. Do not treat “first responding endpoint” as sufficient proof of identity. 8. Add endpoint allowlists, discovery timeouts, rate limits, and an option to restrict operation to localhost. 9. Ensure mDNS advertisements cannot override an explicitly configured endpoint.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The README makes conflicting privacy/security claims: it advertises both 'Zero Logging' and a persistent conversation store with search/export. In a distributed AI platform handling potentially sensitive prompts and outputs, this can mislead users into sharing data under false assumptions about retention and observability. The skill context increases risk because it targets domains like health, law, and education, where conversation content may be sensitive.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The statement that only 'shared_models/' is visible to the mesh conflicts with documented APIs exposing node status, peers, memory, capabilities, scores, discovery, update, and daemon information. Even if these endpoints do not expose filesystem contents, the README overstates isolation and may cause operators to underestimate metadata, hardware, memory, or topology exposure. In a P2P mesh, such misunderstandings materially affect safe deployment decisions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README encourages querying the mesh, sharing models/compute, writing distributed memory, and joining the public mesh without a prominent warning about data exposure, untrusted peers, bandwidth/CPU/GPU use, and possible propagation of shared content. Users may unknowingly contribute resources or place sensitive data into a distributed system, especially given the product's emphasis on auto-discovery and public participation. This is more dangerous in this context because the skill is explicitly designed to connect agents into a live P2P network.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents persistent conversation storage, search, export, and adjustable privacy levels, but it does not present a prominent warning at the feature entry point that user prompts and responses may be retained and later disclosed through export or broader sharing settings. In a P2P AI platform handling potentially sensitive domains like health, law, and education, this can lead users to submit confidential information without understanding retention and disclosure risks.

Static analysis

No suspicious patterns detected.