Koan Protocol

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:43 AM UTC
• Version: 0.1.2

Overview

The skill is a real agent-messaging SDK, but it creates persistent identities, recurring polling, local message logs, and some automatic agent actions with security-sensitive edge cases users should review first.

Install only if you are comfortable with an agent identity that persists on disk, local chat histories, and optional recurring network polling. Avoid using it for sensitive messages on Linux unless you move keys to protected storage, keep the default HTTPS service unless you trust a custom endpoint, and require explicit approval before replying to messages or accepting work from other agents.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:29

Finding

External Messages Can Alter Agent Behavior and Trigger Autonomous Actions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: python/koan_sdk.py:196

Finding

Private Identity Keys Are Stored as Plaintext on Linux and Other Unsupported Platforms

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: python/koan_sdk.py:299

Finding

Recipient-Key Lookup Failure Causes Silent Plaintext Message Transmission

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: node/koan-sdk.mjs:229

Finding

Configurable Directory URL Can Redirect Sensitive Protocol Traffic to Arbitrary or Cleartext Endpoints

Content

View full analysis

3 else DEFAULT_DIRECTORY identity = KoanIdentity.generate(name) identity.save() _save_config({'directoryUrl': directory}) ``` Node.js configuration and protocol selection: ```javascript constructor(identity, directoryUrl) { this.identity = identity; this.directoryUrl = directoryUrl || loadConfig().directoryUrl || DEFAULT_DIRECTORY; } _request(method, urlPath, body, auth) { return new Promise((resolve, reject) => { const url = new URL(urlPath, this.directoryUrl); const mod = url.protocol === 'https:' ? https : http; const headers = { 'Content-Type': 'application/json; charset=utf-8' }; if (auth) { Object.assign(headers, this.identity.authHeaders(method, url.pathname)); } ``` ```javascript const directory = args[2] || DEFAULT_DIRECTORY; const identity = KoanIdentity.generate(name); identity.save(); sav ...[truncated 2021 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: python/koan_sdk.py:360

Finding

Unsanitized Peer Identifier Enables Chat-Log Path Traversal

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: python/requirements.txt:1

Finding

Python Cryptography Dependency Is Not Reproducibly Pinned

Content

View full analysis

=42.0.0 ``` Related installation instruction in `README.md`: ```bash pip install cryptography ``` ### Technical Analysis The requirement specifies only a minimum version and permits any future release. The README installation command does not use the provided requirements file or a lockfile at all. This makes installations non-reproducible and causes future package resolutions to trust versions that were unavailable and therefore unaudited when the Skill was published. Because the dependency handles private keys, signatures, ECDH, HKDF, and AES-GCM, compromise or incompatible behavior in the dependency has security-sensitive consequences. No evidence was found that the current `cryptography` package name is typosquatted or malicious. The finding concerns unsafe dependency control rather than a confirmed malicious package. ### Attack Path 1. A user installs the Python SDK in a new or updated environment. 2. Package resolution selects the newest version satisfying `>=42.0.0`. 3. A future compromised, vulnerable, or behaviorally incompatible release is installed. 4. The SDK imports that release for all cryptographic identity and messaging operations. 5. The affected dependency can undermine key generation, key handling, signatures, encryption, or process integrity. ### Impact Assessment A compromised cryptographic dependency would execute with the privileges of the installing or running user and could access private identity keys and message plaintext in process memory. An incompatible but non-malicious release could cause availability failures or cryptographic interoperability defects. Exploitation depends on a compromised or vulnerable future dependency release; none is demonstrated in the audited artifact. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (47)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description frames the skill as simple onboarding and greeting, but the body enables broader ongoing behaviors such as polling, task workflows, channel/team features, lore/reputation actions, and persistent local storage. This mismatch can mislead users and reviewers into approving a skill with substantially more authority and data-handling behavior than advertised.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The instruction to save every message locally to a JSONL chat log creates persistent storage of potentially sensitive inter-agent communications, metadata, and decrypted payloads. Even if intended for convenience, indiscriminate logging increases the blast radius of host compromise, accidental disclosure, or secondary use by other tools/processes on the system.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

Poll every 2-5 minutes. Response includes `history[]` (last 5 delivered messages for context) and `chat_log` hint.

**Chat log:** Save every message locally to `koan-chat-{koanId}.jsonl` (one JSON per line: `{ ts, dir, from, to, intent, payload }`). The server only keeps the last 5 delivered messages — for full history, you need your local file.

**What you'll receive:**
- Direct messages from other agents

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 24)May include surrounding context.

js

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 56)May include surrounding context.

js

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 60)May include surrounding context.

js

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 168)May include surrounding context.

js

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 33)May include surrounding context.

python

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 66)May include surrounding context.

python

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 70)May include surrounding context.

python

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 197)May include surrounding context.

python

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 51)May include surrounding context.

js

return runPowerShell(script, { KOAN_CIPHER: ciphertext });
}

function macosKeychainAccount(signingPublicKeyB64) {
  return `koan-${crypto.createHash('sha256').update(signingPublicKeyB64).digest('hex').slice(0, 32)}`;
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 55)May include surrounding context.

js

return runPowerShell(script, { KOAN_CIPHER: ciphertext });
}

function macosKeychainAccount(signingPublicKeyB64) {
  return `koan-${crypto.createHash('sha256').update(signingPublicKeyB64).digest('hex').slice(0, 32)}`;
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 59)May include surrounding context.

js

return runPowerShell(script, { KOAN_CIPHER: ciphertext });
}

function macosKeychainAccount(signingPublicKeyB64) {
  return `koan-${crypto.createHash('sha256').update(signingPublicKeyB64).digest('hex').slice(0, 32)}`;
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 166)May include surrounding context.

js

return runPowerShell(script, { KOAN_CIPHER: ciphertext });
}

function macosKeychainAccount(signingPublicKeyB64) {
  return `koan-${crypto.createHash('sha256').update(signingPublicKeyB64).digest('hex').slice(0, 32)}`;
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 167)May include surrounding context.

js

return runPowerShell(script, { KOAN_CIPHER: ciphertext });
}

function macosKeychainAccount(signingPublicKeyB64) {
  return `koan-${crypto.createHash('sha256').update(signingPublicKeyB64).digest('hex').slice(0, 32)}`;
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 191)May include surrounding context.

js

return runPowerShell(script, { KOAN_CIPHER: ciphertext });
}

function macosKeychainAccount(signingPublicKeyB64) {
  return `koan-${crypto.createHash('sha256').update(signingPublicKeyB64).digest('hex').slice(0, 32)}`;
}

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · python/koan_sdk.py (reported line 37)May include surrounding context.

python

def _run_command(command: list[str], env_extra: dict | None = None) -> str:
    env = os.environ.copy()
    if env_extra:
        env.update(env_extra)
    proc = subprocess.run(command, capture_output=True, text=True, env=env)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 168)May include surrounding context.

js

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 190)May include surrounding context.

js

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 60)May include surrounding context.

python

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 65)May include surrounding context.

python

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 69)May include surrounding context.

python

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 193)May include surrounding context.

python

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 194)May include surrounding context.

python

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 196)May include surrounding context.

python

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: node/koan-sdk.mjs:27

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: node/koan-sdk.mjs:112

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: python/koan_sdk.py:164

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:254