T05 · Unauthorized Access and Privilege Escalation
Error
- Location
cloud/server.py:106- Finding
Unauthenticated Paid-Tier Privilege Escalation
- Content
View full analysis
- Remediation
View remediation
Security audit
ConvoYield
Security checks for vulnerabilities and agentic risk
Overview
The local analytics skill is partly coherent, but it also ships under-disclosed cloud billing, telemetry, and cryptocurrency-like features with serious authorization and cryptography flaws.
Install only after reviewing the cloud, dashboard, and ConvoCoin features. The offline analysis engine does not appear to exfiltrate raw conversation text by itself, but avoid using the cloud server, telemetry, billing, marketplace, wallet, mining, or token features in production until authorization, HTTPS enforcement, credential storage, XSS handling, and real cryptographic transaction validation are fixed. Also add clear user consent and data-retention rules before using it to extract contact, budget, referral, or competitive-intelligence signals from real users.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
convoyield/coin/utxo.py:218- Finding
ConvoCoin UTXO Transactions Do Not Verify Ownership or Signatures
- Content
View full analysis
bool: """ Apply a transaction to the UTXO set. 1. Verify all inputs reference valid, unspent UTXOs 2. Remove input UTXOs (spend them) 3. Add output UTXOs (create new ones) Returns True if successful. """ # Coinbase transactions have no inputs to validate if tx.tx_type != "coinbase": # Verify all inputs exist and are unspent for inp in tx.inputs: if inp.utxo_id not in self._utxos: return False # Input doesn't exist or already spent # Verify input sum >= output sum input_sum = sum( self._utxos[inp.utxo_id].amount for inp in tx.inputs ) output_sum = sum(out.amount for out in tx.outputs) if input_sum < output_sum: return False # Trying to spend more than available # Spend inputs for inp in tx.inputs: self.spend(inp.utxo_id) # Create outputs for output in tx.outputs: self.add(output) return True ``` Mempool admission similarly omits signature and ownership validation: ```python # Check: all inputs exist and are unspent input_sum = 0.0 for inp in tx.inputs: utxo = self._utxo_set.get(inp.utxo_id) if utxo is None: return False, f"Input {inp.utxo_id} does not exist" if inp.utxo_id in self._spent_outputs: return False, f"Double-spend: {inp.utxo_id} already claimed" input_sum += utxo.amount # Check: outputs don't exceed inputs output_sum = sum(out.amount for out in tx.outputs) if input_sum < output_sum: ...[truncated 2367 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
convoyield/coin/crypto.py:107- Finding
Signature Verification Accepts Any 64-Character Hexadecimal Value
- Content
View full analysis
bool: """ Verify a signature. In our HMAC scheme, we derive the private key hash to get the public key, so verification requires recomputing from the known public_key -> signature relationship. For a centralized network where the node validates, this works. For true decentralized verification, use ECDSA. """ # In a proper implementation with ECDSA, you'd verify using # only the public key. In our HMAC scheme, we store the # signature and verify by checking it matches the expected # pattern for the public key + message combination. # # This verification is done at the node level where the # node has validated the keypair during registration. expected = hmac.new( public_key.encode(), message.encode(), hashlib.sha256, ).hexdigest() # We verify structural validity — correct length and hex encoding if len(signature) != 64: return False try: int(signature, 16) except ValueError: return False return True ``` ### Technical Analysis The function calculates an `expected` value but never compares it with the supplied signature. The function returns `True` solely when the input is a 64-character hexadecimal string. For example, the following value is accepted without knowledge of any secret: ```text 0000000000000000000000000000000000000000000000000000000000000000 ``` There is also a fundamental design error: HMAC is a symmetric message-authentication mechanism, not a public-key signature algorithm. A verifier cannot validate an HMAC using only a derived public key while preserving the secrecy and ownership properties expected from digital signatures. Even if t ...[truncated 1126 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
cloud/dashboard/index.html:935- Finding
Stored Cross-Site Scripting in the Analytics Dashboard
- Content
View full analysis
p.count)); const colors = [ 'var(--accent-green)', 'var(--accent-blue)', 'var(--accent-purple)', 'var(--accent-yellow)', 'var(--accent-cyan)', 'var(--accent-red)' ]; tbody.innerHTML = plays.slice(0, 8).map((p, i) => `${p.play}${p.count} $${(p.avg_yield || 0).toFixed(2)}`).join(''); } ``` Other renderers follow the same pattern: ```javascript container.innerHTML = convs.map((c, i) => ``) ...[truncated 2800 chars]${c.conversion_type.replace(/_/g, ' ')}$${c.total_value.toFixed(2)}${c.count}x- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
convoyield/cloud/telemetry.py:48- Finding
Sensitive Telemetry and API Credentials Can Be Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (175)
Intent-Code Divergence
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The verification function does not verify the message/signature binding at all; it only checks that the signature is a 64-character hex string and then returns true. Any attacker can forge an arbitrary 'valid' signature by supplying any hex string of the right length, completely defeating authentication and integrity for any transaction or message flow that relies on this check.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README explicitly frames conversations as sources of extractable revenue, data, referrals, and competitive intelligence without any mention of consent, minimization, retention, or user notice. Even though this is documentation rather than executable code, it encourages deployment patterns that can lead to covert profiling and collection of sensitive business or personal information in ways users would not reasonably expect.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The micro-conversion section promotes capturing emails, budgets, pain points, and referral signals as monetizable value, which normalizes harvesting potentially sensitive personal or commercial information from routine chat messages. In bot ecosystems, this can drive operators to collect more data than necessary and use manipulative prompts to elicit information without clear consent or safeguards.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
This finding is primarily about product/packaging drift: industry-specific premium playbook packaging and monetizable strategy registries do not match the claimed real-time analytics engine. While misleading and worth correcting, static premium content by itself is less dangerous than the networking, telemetry, wallet, or billing findings unless it is tied to hidden data collection or execution.
- Content
Static analysis
No suspicious patterns detected.