Koan Team

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:20 AM UTC
• Version: 0.1.2

Overview

This skill is mostly coherent for Koan team coordination, but it bundles broad SDK code with persistent identity keys and network behaviors that deserve careful review before installation.

Install only if you are comfortable with a Koan SDK keeping long-lived identity keys and chat history under ~/.koan. Prefer an OS keychain or encrypted vault, keep the directory URL at the default HTTPS Koan endpoint unless you intentionally trust another server, and avoid using untrusted peer identifiers with the bundled chat-log helpers.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: python/koan_sdk.py:177

Finding

Private Keys Stored in Plaintext on Linux and Other Unsupported Platforms

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: python/koan_sdk.py:255

Finding

Custom Directory Configuration Can Transmit Authentication Data to Arbitrary or Plaintext Network Endpoints

Content

View full analysis

2 else input("Agent name: ") directory = sys.argv[3] if len(sys.argv) > 3 else DEFAULT_DIRECTORY identity = KoanIdentity.generate(name) identity.save() _save_config({'directoryUrl': directory}) ``` Node.js implementation: ```javascript constructor(identity, directoryUrl) { this.identity = identity; this.directoryUrl = directoryUrl || loadConfig().directoryUrl || DEFAULT_DIRECTORY; } _request(method, urlPath, body, auth) { return new Promise((resolve, reject) => { const url = new URL(urlPath, this.directoryUrl); const mod = url.protocol === 'https:' ? https : http; const headers = { 'Content-Type': 'application/json; charset=utf-8' }; if (auth) { Object.assign( headers, ...[truncated 3664 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: python/koan_sdk.py:365

Finding

Unsanitized Peer Identifier Allows Chat-Log Path Traversal

Content

View full analysis

list: log_file = CHATS_DIR / f'{peer}.jsonl' if not log_file.exists(): return [] lines = log_file.read_text(encoding='utf-8').strip().split('\n') return [json.loads(l) for l in lines[-limit:]] ``` ```python elif cmd == 'send': to = sys.argv[2] msg = ' '.join(sys.argv[3:]) result = client.send(to, 'greeting', {'message': msg}) client.log_chat(to, 'sent', 'greeting', {'message': msg}) print(json.dumps(result, indent=2, ensure_ascii=False)) ``` Node.js implementation: ```javascript logChat(peer, direction, intent, payload) { fs.mkdirSync(CHATS_DIR, { recursive: true }); const entry = { ts: new Date().toISOString(), direction, from: direction === 'sent' ? this.identity.koanId : peer, to: direction === 'sent' ? peer : this.identity.koanId, intent, payload, }; fs.appendFileSync( path.join(CHATS_DIR, `${peer}.jsonl`), JSON.stringify(entry) + '\n' ); } recentChats(peer, limit = 20) { const f = path.join(CHATS_DIR, `${peer ...[truncated 3080 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (43)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented behavior materially understates the broader capabilities inherited through the prerequisite ecosystem, including identity registration, local persistence of keys/chat logs, broader messaging, and other networked operations. This mismatch is dangerous because operators may grant or trust the skill for limited team-joining actions while it actually enables handling of sensitive credentials and wider remote interactions without enforceable approval controls.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 24)May include surrounding context.

js

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 56)May include surrounding context.

js

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 60)May include surrounding context.

js

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 168)May include surrounding context.

js

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 33)May include surrounding context.

python

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 66)May include surrounding context.

python

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 70)May include surrounding context.

python

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 197)May include surrounding context.

python

const CONFIG_FILE = path.join(KOAN_DIR, 'config.json');
const CHATS_DIR = path.join(KOAN_DIR, 'chats');
const DEFAULT_DIRECTORY = 'https://koanmesh.com';
const KEYCHAIN_SERVICE = 'koan-protocol-sdk';

function runCommand(command, args, envExtras = {}) {
  const result = spawnSync(command, args, {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 51)May include surrounding context.

js

return runPowerShell(script, { KOAN_CIPHER: ciphertext });
}

function macosKeychainAccount(signingPublicKeyB64) {
  return `koan-${crypto.createHash('sha256').update(signingPublicKeyB64).digest('hex').slice(0, 32)}`;
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 55)May include surrounding context.

js

return runPowerShell(script, { KOAN_CIPHER: ciphertext });
}

function macosKeychainAccount(signingPublicKeyB64) {
  return `koan-${crypto.createHash('sha256').update(signingPublicKeyB64).digest('hex').slice(0, 32)}`;
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 59)May include surrounding context.

js

return runPowerShell(script, { KOAN_CIPHER: ciphertext });
}

function macosKeychainAccount(signingPublicKeyB64) {
  return `koan-${crypto.createHash('sha256').update(signingPublicKeyB64).digest('hex').slice(0, 32)}`;
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 166)May include surrounding context.

js

return runPowerShell(script, { KOAN_CIPHER: ciphertext });
}

function macosKeychainAccount(signingPublicKeyB64) {
  return `koan-${crypto.createHash('sha256').update(signingPublicKeyB64).digest('hex').slice(0, 32)}`;
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 167)May include surrounding context.

js

return runPowerShell(script, { KOAN_CIPHER: ciphertext });
}

function macosKeychainAccount(signingPublicKeyB64) {
  return `koan-${crypto.createHash('sha256').update(signingPublicKeyB64).digest('hex').slice(0, 32)}`;
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 191)May include surrounding context.

js

return runPowerShell(script, { KOAN_CIPHER: ciphertext });
}

function macosKeychainAccount(signingPublicKeyB64) {
  return `koan-${crypto.createHash('sha256').update(signingPublicKeyB64).digest('hex').slice(0, 32)}`;
}

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · python/koan_sdk.py (reported line 37)May include surrounding context.

python

def _run_command(command: list[str], env_extra: dict | None = None) -> str:
    env = os.environ.copy()
    if env_extra:
        env.update(env_extra)
    proc = subprocess.run(command, capture_output=True, text=True, env=env)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 168)May include surrounding context.

js

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · node/koan-sdk.mjs (reported line 190)May include surrounding context.

js

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 60)May include surrounding context.

python

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 65)May include surrounding context.

python

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 69)May include surrounding context.

python

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 193)May include surrounding context.

python

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 194)May include surrounding context.

python

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 196)May include surrounding context.

python

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · python/koan_sdk.py (reported line 227)May include surrounding context.

python

return _run_powershell(script, {'KOAN_CIPHER': ciphertext})


def _macos_keychain_account(signing_public_key_b64: str) -> str:
    digest = hashlib.sha256(signing_public_key_b64.encode()).hexdigest()[:32]
    return f'koan-{digest}'

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: node/koan-sdk.mjs:27

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: node/koan-sdk.mjs:112

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: python/koan_sdk.py:164