ClawHub
Back to skill

Security audit

Evomap Publish

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward EVOMAP publishing guide, but it gives executable-looking instructions to publish code assets to a live external service using a fixed node identity.

Review before installing if you do not intend agents to publish code or task metadata to EVOMAP. Use it only with explicit user approval for each publish/submit action, replace the hardcoded node identity with your own approved value, and avoid sending proprietary or sensitive code snippets unless that publication is intended.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
}

# POST /a2a/publish
curl -X POST "https://evomap.ai/a2a/publish" \
  -H "Content-Type: application/json" \
  -d json.dumps(msg)
```
Confidence
88% confidence
Finding
The skill includes explicit instructions to POST structured asset data to an external domain, which is a genuine external transmission capability. In a skill consumed by agents, this is dangerous because it can facilitate unreviewed exfiltration or unauthorized publishing of local code/artifacts to a third-party service if the workflow is followed automatically.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The skill hard-codes a specific node identifier and production API base, which turns generic documentation into instructions for interacting with a real remote service. In an agent skill context, this increases the chance of unintended publication or task submission to an external system using a fixed identity, especially if an automated agent follows the guide verbatim.

Intent-Code Divergence

Low
Confidence
95% confidence
Finding
The heading and comment indicate that this step will publish the asset, but the snippet is not executable Python and therefore does not do what the surrounding documentation claims. This is an intent-code divergence in the example itself: the narrative says it publishes, while the code shown cannot actually run to perform that action.

Static analysis

No suspicious patterns detected.