Security audit

AgentMesh

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent encrypted agent-messaging library, but it overstates important security guarantees and its network/key-storage guidance needs careful review before installation.

Review this before installing in any sensitive environment. Prefer a pinned commit or release, use LocalHub or bind the network hub to localhost/private networks, add firewalling and authenticated transport before exposing it, and treat persistent key files as long-lived secrets outside source control with restrictive permissions. Do not rely on the current implementation for production-grade forward secrecy or hostile-network security without further hardening.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/agentmesh/hub.py:176
Finding: Unauthenticated Agent Registration Enables Identity Replacement and Message Interception
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/agentmesh/hub.py:90
Finding: Hub Protocol Uses Unauthenticated Plaintext TCP and Exposes Control Operations
Content: View full analysis
dict: with self._lock: if not self._sock: self._connect() self._sock.sendall((json.dumps(msg) + "\n").encode()) return self._pending_resps.get(timeout=10) ``` ```python def start(self, block: bool = True): self._srv_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) self._srv_sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) self._srv_sock.bind((self.host, self.port)) self._srv_sock.listen(128) ``` The server also defaults to all network interfaces: ```python def __init__(self, host: str = "0.0.0.0", port: int = 7700): ``` ### Technical Analysis The network client and server communicate through newline-delimited JSON over raw TCP. There is no TLS, server certificate validation, client authentication, command authentication, or integrity protection for hub control messages. Application payloads are encrypted separately, but public-key discovery, registration, agent identifiers, routing metadata, timestamps, and commands remain observable and modifiable. Because key discovery is itself unauthenticated, an active network attacker can combine protocol interception with public-key substitution. Binding to `0.0.0.0` by default increases exposure by making the service reachable through every configured interface unless external firewall rules prevent access. ### Attack Path 1. An attacker obtains network access to TCP port 7700 or positions themselves between an agent and the hub. 2. The attacker observes plaintext registration, directory queries, agent ...[truncated 837 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/agentmesh/hub.py:99
Finding: Unbounded TCP Frames and Per-Connection Threads Permit Remote Resource Exhaustion
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/agentmesh/crypto.py:173
Finding: Replay Cache Is Updated Before Authentication and Grows Without Bound
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/agentmesh/agent.py:190
Finding: Persistent Private Keys Are Written in Plaintext Without Secure File Permissions
Content: View full analysis
AgentKeyPair: if path.exists(): with path.open() as fh: data = json.load(fh) return AgentKeyPair.from_dict(data) kp = AgentKeyPair() path.parent.mkdir(parents=True, exist_ok=True) with path.open("w") as fh: json.dump(kp.to_dict(), fh, indent=2) return kp ``` The serialized data contains raw private keys encoded only with Base64: ```python return { "identity_private": _b64( self.identity_private.private_bytes( serialization.Encoding.Raw, serialization.PrivateFormat.Raw, serialization.NoEncryption(), ) ), "exchange_private": _b64( self.exchange_private.private_bytes( serialization.Encoding.Raw, serialization.PrivateFormat.Raw, serialization.NoEncryption(), ) ), } ``` ### Technical Analysis `serialization.NoEncryption()` exports raw private-key bytes, and Base64 provides no confidentiality. The key file is created with the process's default umask rather than an explicitly restrictive mode. The code does not validate the existing file's owner or permissions, reject symbolic links, or perform atomic exclusive creation. As a result, keys may be readable by other local users or processes. A pre-created path or symlink can also redirect key output to an unintended filesystem location when the process has permission to write there. ### Attack Path 1. An application enables persistent identities through `keypair_path`. 2. The process creates the JSON file under a permissive umask, or an attacker prepares a symlink at the chosen path. 3. The raw Ed25519 and X25519 private keys are written in Base64 form. 4. Another local principal, compromised ...[truncated 558 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/agentmesh/crypto.py:44
Finding: Static X25519 Exchange Keys Contradict the Advertised Forward-Secrecy Guarantee
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:30
Finding: Recommended Installation Pulls and Executes a Mutable Git Repository
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

Category: YARA Match
Confidence: 85% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · README.md (reported line 33)May include surrounding context.
d25519 signature on every message, impersonation impossible

🔄 Forward secrecy — X25519 ephemeral session keys

🛡️ Replay protection — nonce + counter deduplication

🌐 Local or network — LocalHub (in-process) or NetworkHub (TCP, multi-machine)

📦 One dependency — only cryptography required

🚀 3-line quickstart

📦 Installation

bash
pip install git+https://github.com/cerbug45/AgentMesh.git

Or clone:

bash
git clone https://github.com/cerbug45/AgentMesh.git cd AgentMesh pip install .

🚀 Quick Start

python
from agentmesh import Agent, LocalHub hub = LocalHub() alice = Agent("alice", hub=hub) bob = Agent("bob", hub=hub) @bob.on_message def handle(msg): print(f"[{msg.recipient}] ← {msg.sender}: {msg.text}") alice.send("bob", text="Hello! This is end-to-end encrypted 🔐")

text
[bob] ← alice: Hello! This is end-to-end encrypted 🔐

🌐 Network Mode

**Start the hu

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

Category: YARA Match
Confidence: 85% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
d25519 signature on every message, impersonation impossible

🔄 Forward secrecy — X25519 ephemeral session keys

🛡️ Replay protection — nonce + counter deduplication

🌐 Local or network — LocalHub (in-process) or NetworkHub (TCP, multi-machine)

📦 One dependency — only cryptography required

🚀 3-line quickstart

📦 Installation

bash
pip install git+https://github.com/cerbug45/AgentMesh.git

Or clone:

bash
git clone https://github.com/cerbug45/AgentMesh.git cd AgentMesh pip install .

🚀 Quick Start

python
from agentmesh import Agent, LocalHub hub = LocalHub() alice = Agent("alice", hub=hub) bob = Agent("bob", hub=hub) @bob.on_message def handle(msg): print(f"[{msg.recipient}] ← {msg.sender}: {msg.text}") alice.send("bob", text="Hello! This is end-to-end encrypted 🔐")

text
[bob] ← alice: Hello! This is end-to-end encrypted 🔐

🌐 Network Mode

**Start the hu

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The README advertises automatic key generation and optional persistence but does not warn that private cryptographic keys may be written to local storage, where they could be exposed through weak filesystem permissions, backups, logs, or multi-tenant hosts. In a security-focused messaging tool, omission of storage-safety guidance can lead operators to assume persistence is harmless, increasing the chance of key compromise and identity theft.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The network usage section instructs users to bind the hub server to 0.0.0.0 and connect over raw TCP, but it does not clearly warn that exposing the broker makes routing metadata and a remotely reachable service available to the network. Even if payloads are encrypted, unauthenticated or broadly exposed network services increase attack surface for enumeration, denial of service, and metadata collection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code persists the agent keypair, including private key material, to disk in plaintext JSON without any protection, access control checks, encryption, or warning to the caller. If the filesystem is accessible to another local user, malware, backups, or logs, an attacker could steal the private key and fully impersonate the agent, decrypt future traffic tied to that identity, and undermine trust in the mesh.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The docstring makes a security-relevant claim that the hub never sees message contents and only routes opaque encrypted envelopes, but the implementation parses JSON messages and directly inspects plaintext fields such as cmd, bundle, envelope, envelope['to'], and bundle['agent_id']. This is dangerous because developers or users may rely on the documented privacy/trust boundary and deploy the hub in environments where the broker is assumed unable to read or tamper with metadata or payload structure, leading to misplaced trust and insecure architecture decisions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill documents persistent key storage and briefly notes to store the file securely, but it does not adequately warn that the file contains private key material that may be copied by backups, source control mistakes, shared volumes, or local compromise. This can lead to identity theft of the agent and loss of confidentiality/authentication guarantees for that identity.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: wheel has 4 known advisory(ies) (CVE-2026-24049 (Wheel Affected by Arbitrary File Permission Modification via Path Traversal in w); CVE-2022-40898 (pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)); CVE-2022-40898 (An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlie) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: cryptography has 16 known advisory(ies) (GHSA-39hc-v87j-747x (Vulnerable OpenSSL included in cryptography wheels); CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The dependency is specified as cryptography>=42.0, which allows any future release and does not produce reproducible installs. This increases supply-chain risk because vulnerable or breaking upstream versions could be pulled in without review, and the exact deployed version cannot be audited reliably.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
# AgentMesh – Runtime dependencies cryptography>=42.0 # Development / testing (install with: pip install -r requirements-dev.txt)

Unverifiable Dependency: cryptography has 16 known advisory(ies) (GHSA-39hc-v87j-747x (Vulnerable OpenSSL included in cryptography wheels); CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: Because cryptography is not pinned, it is impossible to verify from this manifest whether the installed version avoids known advisories affecting some releases. In a security-sensitive library like cryptography, version ambiguity is especially risky because the package directly implements core cryptographic functionality and may bundle vulnerable components in some versions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

📦 Installation

🚀 Quick Start

🌐 Network Mode

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

📦 Installation

🚀 Quick Start

🌐 Network Mode

Missing User Warnings

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Unpinned Dependencies

Static analysis