T09 · Insecure Skill Coding Practices
Error
- Location
handshake/resonance_manifest.py:308- Finding
Gateway allowlist violations do not block session hydration
- Content
View full analysis
- Remediation
View remediation
Security audit
Asin Governance
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but its governance and safety promises are undercut by fail-open checks, broad activation, credential-backed Moltbook access, and a standalone session server.
Install only if you are comfortable reviewing and tightening the security controls first. Treat it as experimental governance tooling, avoid production credentials, do not rely on its oracle or entropy gates as written, and be aware that the heartbeat can use your Moltbook API key and write persistent local logs and token secrets.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
handshake/resonance_manifest.py:280- Finding
Session hydration does not enforce entropy budgets
- Content
View full analysis
Dict[str, Any]: """ Check if node has remaining entropy budget for a new session. Returns status dict with available budget. """ budget = profile.get("entropy_budget", {}) # In a real implementation, this would query the history/actions.log # For now, we assume the profile's configured budget is the daily allocation return { "daily_compute_seconds": budget.get("daily_compute_seconds", 3600), "daily_api_calls": budget.get("daily_api_calls", 500), "daily_tokens": budget.get("daily_tokens", 1000000), "energy_unit": budget.get("energy_unit", "arbitrary"), } # 4. Check entropy budget entropy = self._check_entropy_budget(profile) # Minimal session hydration cost: ~5s compute, 1 API call, 500 tokens if not force: # Simulate budget check — in production, query history/actions.log # For now, we always allow but log the cost pass # Budget always available in this implementation ``` ### Technical Analysis The method named `_check_entropy_budget()` returns configured daily allocations rather than calculating remaining capacity. The subsequent authorization branch explicitly performs no check and always allows hydration. This conflicts with the declared functionality that every autonomous action and session hydration must be blocked when its entropy budget is exhausted. Logging a nominal cost after authorization is not equivalent to reserving or enforcing a budget. Because the standalone exchange endpoint invokes `ResonanceManifestEngine.hydrate()` directly, this no-op check is part of the active endpoint path rather than merely unused scaffolding. ### Attack Path 1. An authorized node repeatedly submits valid ...[truncated 928 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
sandbox/adversarial.py:32- Finding
Adversarial safety checks fail open for configured rule identifiers
- Content
View full analysis
bool: """Returns True if rule would BLOCK this payload.""" check = rule.get("check", "") if check == "no_pii_leak": content = str(payload.get("content", "")) if "moltbook_" in content or "api_key" in content.lower(): return True # Simple email/phone patterns if "@" in content and "." in content.split("@")[-1]: return True elif check == "rate_limit_gate": # Always pass in fuzzer — rate limits are temporal return False elif check == "content_sanity": title = payload.get("title", "") if len(title) > 300: return True if len(title) == 0: return True elif check == "pass_through": return False elif check == "domain_whitelist": # Domain check happens at transport layer, not payload return False elif check == "semantic_dedup": # Would need corpus — simulate return False elif check == "karma_impact_model": # Would need history — simulate return False elif check == "context_verifier": # Would need session context — simulate return False return False # Default: allow ``` The safety configuration uses a different identifier: ```json { "id": "R001", "name": "no_pii_leak", "pattern": "post_content", "check": "content_sanitizer", "severity": "red", "description": "Block if post contains emails, phone numbers, API keys, or credentials" } ``` ### Technical Analysis The fuzzer implements checks named `no_pii_leak` and `content_sanity`, but the safety configuration assigns `content_sanitizer` to R001 and R004. No ...[truncated 1589 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
constraints/handshake_validator.py:126- Finding
Entropy accounting fails open when the audit history is malformed or unreadable
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
handshake/token_engine.py:165- Finding
Existing HMAC secret files are loaded without ownership or permission validation
- Content
View full analysis
str: """Load or generate a node's HMAC secret from the local vault.""" if node_id in self._secrets_cache: return self._secrets_cache[node_id] secret_path = self._node_secret_path(node_id) if secret_path.exists(): secret = secret_path.read_text().strip() else: # Generate a cryptographically secure 256-bit secret secret = secrets.token_hex(32) self.vault_dir.mkdir(parents=True, exist_ok=True) secret_path.write_text(secret) # Restrict permissions: owner read-only os.chmod(secret_path, 0o600) self._secrets_cache[node_id] = secret return secret ``` ### Technical Analysis New secret files are changed to mode `0600`, but existing files are accepted without checking: - File ownership - Group or world permissions - File type - Symbolic-link status - Secret length or format A pre-existing group-readable or world-readable HMAC key can therefore remain exposed while being trusted for token signing and verification. The code also uses separate write and `chmod` operations for new files, creating a short interval in which permissions depend on the process umask. The issue concerns the Skill’s own vault secrets. The audit found no SSH-key access, SSH operation, or unrelated credential harvesting. ### Attack Path 1. A vault secret exists with permissions allowing another local account to read it, or it is created insecurely outside this code path. 2. The token engine loads the file without validating or correcting its ownership and mode. 3. A local attacker reads the HMAC key. 4. The attacker constructs token payloads containing a permitted node ID, scope, expiration, and gateway. 5. The attacker computes a valid HMAC-S ...[truncated 646 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (44)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The sandbox/adversarial component performs mutation fuzzing, injection-payload generation, and report writing, which goes beyond passive governance and introduces active security testing behavior. Even if intended for defensive validation, packaging offensive-style payload generation inside a broadly activated governance skill increases the chance of misuse or accidental execution in the wrong context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The sandbox/adversarial component performs mutation fuzzing, injection-payload generation, and report writing, which goes beyond passive governance and introduces active security testing behavior. Even if intended for defensive validation, packaging offensive-style payload generation inside a broadly activated governance skill increases the chance of misuse or accidental execution in the wrong context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The sandbox/adversarial component performs mutation fuzzing, injection-payload generation, and report writing, which goes beyond passive governance and introduces active security testing behavior. Even if intended for defensive validation, packaging offensive-style payload generation inside a broadly activated governance skill increases the chance of misuse or accidental execution in the wrong context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The sandbox/adversarial component performs mutation fuzzing, injection-payload generation, and report writing, which goes beyond passive governance and introduces active security testing behavior. Even if intended for defensive validation, packaging offensive-style payload generation inside a broadly activated governance skill increases the chance of misuse or accidental execution in the wrong context.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code documents oracle consultation as a required precondition for hydration, but it never enforces an oracle decision or blocks when no positive oracle result exists. In a governance/safety gate skill, this is a security control failure: sessions can be hydrated despite the advertised safety boundary, enabling unauthorized or insufficiently reviewed actions.
- Content
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 94% confidence
- Finding
The force parameter provides a built-in bypass for constraint checks in the very component meant to enforce governance controls. Because the bypass is not backed by a cryptographically verifiable human approval workflow, any caller able to set force=True can potentially skip risk gating and hydrate sessions that should be blocked.
- Content
python Args: token: Validated SessionToken force: Bypass constraint checks (requires human approval) Returns: {"success": True, "manifest": {...}} or
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
python Args: token: Validated SessionToken force: Bypass constraint checks (requires human approval) Returns: {"success": True, "manifest": {...}} or
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
python Args: token: Validated SessionToken force: Bypass constraint checks (requires human approval) Returns: {"success": True, "manifest": {...}} or
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 94% confidence
- Finding
The CLI exposes the same force bypass as a user-controllable flag, making constraint evasion directly accessible from the command line. In a governance skill, exposing a trivial override materially weakens the trust boundary and invites accidental or deliberate misuse.
- Content
python parser = argparse.ArgumentParser(description="ASH-0.2 Resonance Manifest Engine") parser.add_argument("--token", required=True, help="Compact token string to hydrate") parser.add_argument("--force", action="store_true", help="Bypass constraint checks (human approval required)") parser.add_argument("--json", action="store_true", help="Output JSON only") args = parser.parse_args()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
Referencing a fixed credentials file path for automatic token acquisition is a credential-access pattern that can normalize silent secret harvesting by agent skills. Even though the script uses the token for its stated integration rather than exfiltrating it directly, embedding this behavior in a governance skill materially increases risk because a trusted infrastructure component gains access to unrelated secrets.
- Content
sh # Load Moltbook API key MOLTBOOK_API_BASE="https://www.moltbook.com/api/v1" CREDENTIALS_FILE="$HOME/.config/moltbook/credentials.json" API_KEY="" if [ -n "${MOLTBOOK_API_KEY:-}" ]; then
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 82% confidence
- Finding
The YARA hit itself is likely a false-positive on wording, but the underlying code pattern is problematic: multiple safety checks are stubbed to return allow, and the function ends with a default-allow fallback for unknown rule types. In a governance/safety context, this fail-open behavior makes the tool’s outputs unreliable and can normalize unsupported controls as safe, which is dangerous if users depend on it for security decisions.
- Content
python return True if len(title) == 0: return True elif check == "pass_through": return False elif check == "domain_whitelist": # Domain check happens at transport layer, not payload return False elif check == "semantic_dedup": # Would need corpus — simulate return False elif check == "karma_impact_model": # Would need history — simulate return False elif check == "context_verifier": # Would need session context — simulate return False return False # Default: allow def fuzz_payload(base_payload: dict, safety_rules: dict) -> list: """Generate mutations and test which bypass safety.""" results = [] for name, mutator in MUTATIONS.items(): mutated = mutator(base_payload) # Test against all applicable rules triggered_rules = [] for rule in safety_rules.get("rules", []):
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
python return False # Default: allow def fuzz_payload(base_payload: dict, safety_rules: dict) -> list: """Generate mutations and test which bypass safety.""" results = [] for name, mutator in MUTATIONS.items():
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
python return False # Default: allow def fuzz_payload(base_payload: dict, safety_rules: dict) -> list: """Generate mutations and test which bypass safety.""" results = [] for name, mutator in MUTATIONS.items():
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh # Rollback check echo "↩️ Rollback capability..." case $ACTION in post) ROLLBACK="DELETE /api/v1/posts/{id}" ;; comment) ROLLBACK="DELETE /api/v1/comments/{id} (if supported)" ;; upvote) ROLLBACK="DELETE /api/v1/posts/{id}/upvote" ;; follow) ROLLBACK="DELETE /api/v1/agents/{name}/follow" ;;
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh echo "↩️ Rollback capability..." case $ACTION in post) ROLLBACK="DELETE /api/v1/posts/{id}" ;; comment) ROLLBACK="DELETE /api/v1/comments/{id} (if supported)" ;; upvote) ROLLBACK="DELETE /api/v1/posts/{id}/upvote" ;; follow) ROLLBACK="DELETE /api/v1/agents/{name}/follow" ;; *) ROLLBACK="none" ;;
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh case $ACTION in post) ROLLBACK="DELETE /api/v1/posts/{id}" ;; comment) ROLLBACK="DELETE /api/v1/comments/{id} (if supported)" ;; upvote) ROLLBACK="DELETE /api/v1/posts/{id}/upvote" ;; follow) ROLLBACK="DELETE /api/v1/agents/{name}/follow" ;; *) ROLLBACK="none" ;; esac
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh post) ROLLBACK="DELETE /api/v1/posts/{id}" ;; comment) ROLLBACK="DELETE /api/v1/comments/{id} (if supported)" ;; upvote) ROLLBACK="DELETE /api/v1/posts/{id}/upvote" ;; follow) ROLLBACK="DELETE /api/v1/agents/{name}/follow" ;; *) ROLLBACK="none" ;; esac echo " Method: $ROLLBACK"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill describes capabilities that imply file access, file writes, shell execution, and network interaction, but it declares no explicit tool scope or permission boundary. In an agent ecosystem, this omission can cause the runtime or reviewer to underestimate what the skill can do, enabling overprivileged execution and reducing the effectiveness of policy enforcement.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The 'when to use' language is so broad that it can trigger this skill for nearly any autonomous action, including contexts where its higher-risk capabilities are unnecessary. Overbroad activation increases attack surface, encourages privilege creep, and makes it easier for hidden features like token handling or shell/network workflows to be invoked unintentionally.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md 4. History log (append action record) 5. Post-action audit (update outcome, check for drift) See `skills/moltbook-interact/SKILL.md` for the Moltbook API surface. ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This is a true fail-open condition in quota enforcement: if reading or parsing the history log raises an exception, the code silently ignores the error and proceeds as though budget is available. An attacker or misbehaving local process that corrupts, locks, replaces, or makes the log unreadable could bypass entropy-budget checks and obtain permission for exchanges that should be denied.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest describes this skill as a governance substrate providing constraint enforcement, safety oracle, drift detection, entropy accounting, and rollback support. This module instead presents a handshake/session subsystem with token generation, session hydration, and an API exchange endpoint, which is a distinct authentication/session-establishment capability rather than governance or audit functionality.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The endpoint writes exchange metadata, including node_id and client_ip, to a predictable local file under the user's home directory without any consent, disclosure, retention control, or access hardening. In this skill context, which handles session exchange and governance decisions, such logging can expose sensitive operational metadata and create a privacy or lateral-intelligence leak if the host is shared or compromised.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says the skill is 'part of the federated stack — not standalone', implying it should act as an embedded governance component. However, this file includes a complete CLI/server entrypoint that binds a TCP server, exposes POST and health endpoints, and runs indefinitely as an independent service.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Entropy budget enforcement is described as a gating control, but the implementation explicitly does nothing and always permits hydration. This allows unlimited session creation regardless of configured resource or risk budgets, undermining rate limiting, abuse prevention, and governance guarantees.
- Content