Security audit

Evolver.Bak

Security checks for vulnerabilities and agentic risk

Overview

This self-evolution skill needs Review because it can automatically drive code changes, contact an external hub with transcript-derived data, and force-update executable skills by default.

Install only in an isolated, git-backed workspace with no sensitive conversations, credentials, or private project data available to the agent. Treat --review as advisory, not a hard safety control; disable bridge execution, disable auto-update, and block or explicitly control outbound hub access before using it on real work.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: src/gep/prompt.js:7
Finding: Untrusted Hub Content Can Direct Automatic Repository Modification
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/gep/taskReceiver.js:15
Finding: Private Conversation and Runtime Details Are Transmitted to an External Hub Without Sanitization
Content: View full analysis
0) { var featureContext = featureLines[0].replace(/\s+/g, ' ').trim().slice(0, 150); candidates.push({ question: 'User requested a feature that may benefit from community solutions: ' + featureContext + ' -- Are there existing implementations or best practices for this?', amount: 0, signals: ['user_feature_request', 'community_solution_sought'], priority: 1, }); } } ``` ```js const HUB_URL = process.env.A2A_HUB_URL || process.env.EVOMAP_HUB_URL || 'https://evomap.ai'; async function fetchTasks(opts) { const o = opts || {}; const nodeId = getNodeId(); if (!nodeId) return { tasks: [] }; try { const payload = { asset_type: null, include_tasks: true, }; if (Array.isArray(o.questions) && o.questions.length > 0) { payload.questions = o.questions; } const msg = { protocol: 'gep-a2a', protocol_version: '1.0.0', message_type: 'fetch', message_id: `msg_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`, sender_id: nodeId, timestamp: new Date().toISOString(), payload, }; ...[truncated 3008 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: src/evolve.js:451
Finding: Default Force-Update Replaces Executable Skills Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: src/gep/envFingerprint.js:13
Finding: Persistent Device and Environment Fingerprint Is Sent During Hub Registration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (170)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: execSync(process.env.INTEGRATION_STATUS_CMD, ...) executes arbitrary shell from an environment variable, which is equivalent to arbitrary command execution in the agent's privilege context. Any attacker or misconfigured wrapper that can influence environment variables can run OS commands, read secrets, or alter the workspace.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Environment fingerprint collection, host/working-directory hashing, and classification in tests still indicate capability for stable environment identification. This remains sensitive because it can facilitate tracking across runs or installations beyond user expectations.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.js:164

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/build_public.js:169

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/generate_history.js:17

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/publish_public.js:13

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/recover_loop.js:19

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/suggest_version.js:27

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/evolve.js:276

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/gep/solidify.js:64

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/ops/health_check.js:20

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/ops/lifecycle.js:27

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/ops/self_repair.js:17

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/ops/skills_monitor.js:96

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/gep/a2aProtocol.js:75

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/gep/hubSearch.js:18

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/gep/memoryGraphAdapter.js:77

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/gep/taskReceiver.js:11

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test/sanitize.test.js:12