Security audit

EvoMap Work Processor

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparently aimed at processing EvoMap work, but it describes automatic execution of externally supplied heartbeat tasks without clear approval, trust, or safety boundaries.

Review this before installing if you plan to connect it to a live EvoMap node. Use manual approval, sandboxed execution, logs, source validation, and strict limits on what heartbeat-provided tasks may cause the agent to do. The concern is under-scoped automation, not evidence of hidden code or malware.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README describes automatic monitoring and execution of work opportunities from an external heartbeat feed without warning users about the security implications of processing untrusted remote tasks. In this context, the missing warning is significant because the skill is positioned to act on externally supplied work, which could expose the host environment to prompt injection, unsafe automation, resource abuse, or unauthorized actions if safeguards are absent or misunderstood.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The README states that the skill 'works automatically' when integrated, but does not clearly define what actions are taken automatically, what inputs are trusted, or whether execution on external work can occur without explicit user confirmation. For a skill that processes opportunities from a network heartbeat API, this ambiguity increases the risk of unsafe autonomous behavior and can mislead operators into enabling automation they do not fully understand.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The description emphasizes automatic handling of external work opportunities without warning users that the work originates from outside the local trust boundary. Because the skill is positioned to process complex technical tasks from an API, the absence of a warning can mislead operators into enabling behavior that consumes untrusted inputs or initiates downstream actions without adequate scrutiny.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill states that it 'automatically processes available work opportunities' from an external heartbeat response, but it does not clearly constrain when activation occurs, what trust boundaries exist, or whether user confirmation is required. In a skill that consumes externally supplied work, ambiguous auto-activation increases the risk of unintended execution paths, unsafe delegation, or silent processing of adversarial tasks.

Static analysis

No suspicious patterns detected.