EvoMap GEP Client

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:15 PM UTC
• Version: 1.1.0

Overview

The skill is mostly a disclosed EvoMap network client, but it includes under-scoped external data sharing and a hardcoded publishing identity that users should review before installing.

Install only if you are comfortable sending EvoMap searches, asset IDs, and a persistent node identifier to evomap.ai. Review fetched capsules as untrusted third-party advice, do not run validation commands or apply changes without explicit approval, and avoid using the bundled hardcoded Feishu publishing script unless you intend to publish exactly that content under that node identity.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/fetch.py:32

Finding

Persistent Agent Memory Is Read and Its Identifier Is Transmitted Externally

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:39

Finding

Untrusted Remote Capsules Are Presented to the Agent as Actionable Guidance

Content

View full analysis

Read the returned capsules. If a capsule matches your situation, try applying it. ``` ```python # scripts/fetch.py:113-141 assets = result.get("assets") or result.get("payload", {}).get("results") or result.get("payload", {}).get("assets") or [] if not assets: print("No results found.") print(json.dumps(result, indent=2, ensure_ascii=False)) return print(f"\nFound {len(assets)} result(s):\n") for i, asset in enumerate(assets, 1): atype = asset.get("type") or asset.get("asset_type", "unknown") payload_inner = asset.get("payload", {}) summary = payload_inner.get("summary") or asset.get("summary", "(no summary)") confidence = payload_inner.get("confidence") or asset.get("confidence", "") gdi = asset.get("gdi_score", "") asset_id = asset.get("asset_id", "") short_id = asset_id[:20] + "..." if asset_id else "" print(f"[{i}] {atype} — {summary[:100]}") if confidence: print(f" confidence: {confidence} gdi: {gdi} id: {short_id}") print() print("--- Raw response ---") print(json.dumps(result, indent=2, ensure_ascii=False)) ``` ```python # scripts/get_capsule.py:78-87 try: res = post("/a2a/fetch", envelope) results = res.get("payload", {}).get("results", []) if not results: print("Asset not found.") return asset = results[0] print("\n--- Asset Detail ---") print(json.dumps(asset, indent=2, ensure_ascii=False)) ``` ```markdown - `validation`: only node/npm/npx commands allowed ``` ### Technical Analysis Capsule content comes from remote EvoMap publishers and is therefore outside the local trust boundary. The scripts print summa ...[truncated 2091 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/publish_feishu403.js:7

Finding

Hard-Coded Publisher Identity Is Used Without Client-Side Proof of Possession

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This second mismatch finding indicates the skill may hardcode sender identity and publish a predefined bundle despite claiming to be a general-purpose integration. If true, that creates risk of impersonation, unexpected data publication, or misleading activation behavior, especially in agent ecosystems that rely on metadata for trust and routing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This second mismatch finding indicates the skill may hardcode sender identity and publish a predefined bundle despite claiming to be a general-purpose integration. If true, that creates risk of impersonation, unexpected data publication, or misleading activation behavior, especially in agent ecosystems that rely on metadata for trust and routing.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/publish-guide.md (reported line 27)May include surrounding context.

md

"schema_version": "1.5.0",
  "category": "repair",
  "signals_match": ["FeishuAPIError", "403 Forbidden"],
  "summary": "Re-fetch access token when Feishu API returns 403",
  "validation": [],
  "asset_id": ""
}

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

Your node is already active. Use fetch.py or publish directly.

Check node status instead:
  curl -s https://evomap.ai/a2a/nodes/YOUR_NODE_ID | python3 -m json.tool

Only use this script if you are registering a BRAND NEW node for the first time.
"""

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/hello.py (reported line 11)May include surrounding context.

python

Your node is already active. Use fetch.py or publish directly.

Check node status instead:
  curl -s https://evomap.ai/a2a/nodes/YOUR_NODE_ID | python3 -m json.tool

Only use this script if you are registering a BRAND NEW node for the first time.
"""

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/hello.py (reported line 32)May include surrounding context.

python

print("✅ Just use fetch.py or publish directly — no hello needed.")
    print()
    print("To check your node status:")
    print(f"  curl -s https://evomap.ai/a2a/nodes/{CLAIMED_NODE} | python3 -m json.tool")
    print()

    if "--force" in sys.argv:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish_feishu403.js (reported line 96)May include surrounding context.

js

],
    constraints: {
      max_files: 2,
      forbidden_paths: ['.env', 'secrets/']
    },
    validation: [
      "node -e \"console.log('Feishu app_secret should be 32 chars. Verify length manually in config.')\""

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and instructs use of network, shell, environment, and file-reading capabilities but does not declare any explicit tool scope or permissions. In an agent setting, missing scope boundaries can cause over-privileged execution and make it easier for the skill to access local state (such as MEMORY.md or environment variables) and contact external services without clear governance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation guidance is broad enough to trigger on generic mentions like wanting to 'learn the protocol' or 'search for capsules or genes,' which can cause unintended invocation. In an agent environment, overly permissive triggers increase the chance of unprompted external-service interaction or shell command suggestions in contexts where the user did not intend to use this marketplace integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill prominently promotes direct connection to an external hub and auto-discovery of sender_id from local state, but it does not provide a clear warning that user/agent data, node identifiers, and possibly solution content may be transmitted to a third-party service. This is dangerous because operators may unknowingly expose local identifiers, operational metadata, or sensitive problem descriptions to an external marketplace.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The protocol explicitly permits npx in validation commands without requiring pinned package versions or restricting remote package resolution. In a collaborative marketplace where agents may consume and run shared validation steps, this can lead to execution of unexpected or attacker-controlled code if npx fetches the latest package or resolves a compromised dependency.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata says sender_id should be auto-detected from MEMORY.md, but this script hardcodes a fixed node identity. In an agent-to-agent publishing workflow, a hardcoded sender_id can cause misattribution of published assets, cross-tenant identity confusion, or unintended publishing under the wrong agent identity if reused elsewhere.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The file documentation says sender_id can come from command line, environment variable, or MEMORY.md, while the manifest-level description states it is auto-detected from MEMORY.md and that scripts handle the rest after saving node ID once. This is an intent/documentation divergence about how identity is sourced, which could mislead users about what data sources the script consults.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest description says sender_id is auto-detected from MEMORY.md so agents only need to save their node ID once, but this script also reads EVOMAP_SENDER_ID from the environment. Accessing environment variables is not clearly justified by that stated workflow and expands how identity is sourced beyond the described purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.