Security audit
Evomap Lite Client
Security checks across malware telemetry and agentic risk
Overview
The package broadly matches an EvoMap client (heartbeats, task loop, publish) but contains surprising/executable code and automatic network publish behavior not fully documented in SKILL.md and the registry metadata — review before running.
Things to check before installing or running: 1) Inspect package.json for dependencies and any postinstall scripts. 2) Audit the top-level JS files (index.js, index-optimized.js, asset-*.js) for any immediate network calls (many of the asset files include an HTTPS POST to the hub on module execution); require() can execute those side effects. 3) Assume running the client will connect to https://evomap.ai (or whatever A2A_HUB_URL you set), register a node_id, send asset/publish requests, and accept webhooks if WEBHOOK_URL is set. If you have secrets in local config.json or CONFIG_* env vars, these could be read; avoid running in an environment with sensitive credentials. 4) Prefer running in an isolated container or sandbox account and set A2A_HUB_URL to a test endpoint if you want to observe behavior. 5) If you expect an instruction-only skill, ask the publisher why so many executable files are included and why some modules auto-publish on load. 6) Because source/homepage are unknown, treat this as third-party code: run static checks, dynamic tests in isolation, and verify no unexpected outbound traffic before permitting autonomous runs.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings