Security audit

MYR

Security checks for vulnerabilities and agentic risk

Overview

The skill’s purpose is coherent, but it recommends running mutable external code and optionally keeping a peer-sync server running persistently.

Review this before installing. Prefer downloading or cloning a pinned release, inspecting the installer, and verifying checksums or signatures before running anything. Do not enable the launchd service or peer auto-approval unless you understand what reports and node metadata will be reachable, have restricted network access, and know how to disable the service later.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:26
Finding: Mutable Remote Installation Script Executed Directly by Bash
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: SKILL.md:125
Finding: Persistent Auto-Restarting MYR Network Service
Content: View full analysis
Label com.myr.server ProgramArguments /usr/local/bin/node /path/to/myr-system/server/index.js WorkingDirectory /path/to/myr-system EnvironmentVariables MYR_HOME /path/to/myr-system RunAtLoad KeepAlive StandardOutPath /path/to/myr-system/logs/server.log StandardErrorPath /path/to/myr-system/logs/server-error.log ``` ```bash mkdir -p $MYR_HOME/logs launchctl load ~/Library/LaunchAgents/com.myr.server.plist ``` ### Technical Analysis The instructions register the MYR HTTP server as a user LaunchAgent. `RunAtLoad` causes it to start when the agent is loaded, while `KeepAlive` directs `launchd` to restart it after termination. This creates execution that persists across interactive Skill runs and user login sessions. A persistent service is consistent with the optional live peer-synchronization feature, but it is not necessary for one-shot operations such as storing, searching, signing, importing, or exporting reports. The example does not present persistence as a separately consented security-sensitive action, pin the executed server code, constrain network binding, or provide corresponding unload and removal instructions. Because the service executes JavaScript from a writable project path, subsequent tampering with `s ...[truncated 1247 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:40
Finding: Unpinned Repository and npm Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill recommends executing a remote script directly with curl piped to bash without a strong warning or integrity-verification step. This is dangerous because any compromise of the upstream repository, network path, or referenced script would immediately lead to arbitrary code execution on the user's machine.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: Piping curl output into bash is a classic command-chaining abuse pattern because it combines network retrieval with immediate execution in a single unreviewed step. This eliminates opportunities for integrity inspection and makes any upstream compromise translate directly into code execution.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
One-step install (recommended)

bash
curl -fsSL https://raw.githubusercontent.com/JordanGreenhall/myr-system/main/install.sh | bash

This clones the repo, installs dependencies, generates your keypair, prompts for a node ID, runs the five-command ping test, and adds MYR_HOME to your shell. Node is operational when it completes.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list contains very broad phrases such as "MYR", "what did we learn about", and "peer sync" that could match ordinary conversation and unintentionally activate this skill. Because the skill includes installation, networking, persistence, and data-sharing instructions, accidental invocation raises the chance of risky actions being suggested in unrelated contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The live peer-sync section encourages exposing an HTTP service and sharing reports with peers, but does not prominently warn about the privacy and confidentiality implications of networked synchronization. Users may enable sharing without understanding that operational insights, metadata, node identity, and report contents could be disclosed to other systems.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: The skill provides instructions to install the server as a persistent launchd agent, causing the network service to start automatically and remain resident. Persistence is security-relevant because it increases exposure duration and can leave a sharing service active beyond the user's immediate intent.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
Run as a persistent service (macOS launchd)

Create ~/Library/LaunchAgents/com.myr.server.plist:

xml
<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.
xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The explicit launchctl load command activates the persistent auto-start service, which means the HTTP sync server will continue running across sessions. In the context of a networked data-sharing service, this can unintentionally maintain exposure to remote peers and increase the window for misuse or attack.
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
bash
mkdir -p $MYR_HOME/logs launchctl load ~/Library/LaunchAgents/com.myr.server.plist

Verify:

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The explicit launchctl load command activates the persistent auto-start service, which means the HTTP sync server will continue running across sessions. In the context of a networked data-sharing service, this can unintentionally maintain exposure to remote peers and increase the window for misuse or attack.
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
bash
mkdir -p $MYR_HOME/logs launchctl load ~/Library/LaunchAgents/com.myr.server.plist

Verify:

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The skill introduces an auto-approve capability that allows the system to trust remote peers based on automated checks alone. Even with fingerprint consistency checks, this reduces human verification and can enable unintended trust relationships if discovery data, environment trust assumptions, or verification logic are flawed.
Content: Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.
md
When adding a peer with `myr peer add --url <url>`, MYR fetches the peer's discovery document and sends an introduce request. In v1.2.0, the announce body includes `fingerprint`, `node_uuid`, and `protocol_version` fields for in-band verification. ### Auto-approve verified peers Set `auto_approve_verified_peers: true` in your node config (`~/.myr/config.json` or `config.json`) to automatically trust peers that pass 3-way fingerprint verification:

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: This configuration guidance explicitly tells users to set auto_approve_verified_peers to true, enabling automated trust decisions for remote peers. In a networked synchronization system, automatic trust can expand the blast radius of verification mistakes or environmental compromise by admitting malicious or misidentified peers without operator review.
Content: Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.
Auto-approve verified peers

Set auto_approve_verified_peers: true in your node config (~/.myr/config.json or config.json) to automatically trust peers that pass 3-way fingerprint verification:

json
{

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The JSON example operationalizes autonomous trust by giving a ready-to-copy configuration that enables peer auto-approval. Copy-pasteable insecure examples increase real-world adoption of risky defaults and make it more likely users will enable trust automation without understanding the consequences.
Content: Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.
json
{ "auto_approve_verified_peers": true, "auto_approve_min_protocol_version": "1.2.0" }

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The minimum protocol version field is presented as if version gating is sufficient for safe automatic approval, which may overstate the protection provided by protocol checks. A compliant or spoofed protocol version does not prove the peer is benign, so this can create false confidence in autonomous trust decisions.
Content: Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.
json
{ "auto_approve_verified_peers": true, "auto_approve_min_protocol_version": "1.2.0" }

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: The documentation states that peers passing automated verification are immediately trusted, which is a direct autonomous authorization action. Immediate trust can permit report access or synchronization before a human validates the peer relationship, increasing the risk of unauthorized data exchange.
Content: Scanner excerpt · SKILL.md (reported line 298)May include surrounding context.
text
When enabled: - Peers announcing with protocol version ≥ `auto_approve_min_protocol_version` (default `1.2.0`) that pass 3-way verification are immediately trusted. - A reciprocal announce is sent automatically so both sides can establish trust in a single round-trip. - The `auto_approved` flag is recorded in the peer record for audit.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The mention that an auto_approved flag is recorded for audit is not itself dangerous; it is an auditability feature rather than the risky behavior. The underlying concern is the auto-approval mechanism, not the existence of an audit field.
Content: Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.
md
When enabled: - Peers announcing with protocol version ≥ `auto_approve_min_protocol_version` (default `1.2.0`) that pass 3-way verification are immediately trusted. - A reciprocal announce is sent automatically so both sides can establish trust in a single round-trip. - The `auto_approved` flag is recorded in the peer record for audit. **Security note:** Only enable auto-approve on nodes where you trust the network environment. On untrusted networks, keep manual approval (`auto_approve_verified_peers: false`, the default) and verify fingerprints out-of-band.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.
md
- A reciprocal announce is sent automatically so both sides can establish trust in a single round-trip. - The `auto_approved` flag is recorded in the peer record for audit. **Security note:** Only enable auto-approve on nodes where you trust the network environment. On untrusted networks, keep manual approval (`auto_approve_verified_peers: false`, the default) and verify fingerprints out-of-band. ---

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.
md
- A reciprocal announce is sent automatically so both sides can establish trust in a single round-trip. - The `auto_approved` flag is recorded in the peer record for audit. **Security note:** Only enable auto-approve on nodes where you trust the network environment. On untrusted networks, keep manual approval (`auto_approve_verified_peers: false`, the default) and verify fingerprints out-of-band. ---

External Script Fetching

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: Fetching and executing an external script directly from a remote URL delegates trust to mutable third-party content at runtime. If the script or hosting source is compromised, users would execute attacker-controlled code immediately with their local shell privileges.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
One-step install (recommended)

bash
curl -fsSL https://raw.githubusercontent.com/JordanGreenhall/myr-system/main/install.sh | bash

This clones the repo, installs dependencies, generates your keypair, prompts for a node ID, runs the five-command ping test, and adds MYR_HOME to your shell. Node is operational when it completes.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T06 · System Persistence

T08 · Insecure Dependencies

SkillSpector

Missing User Warnings

Chaining Abuse

One-step install (recommended)

Vague Triggers

Missing User Warnings

Session Persistence

Run as a persistent service (macOS launchd)

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Autonomous Decision Making

Autonomous Decision Making

Auto-approve verified peers

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

External Script Fetching

One-step install (recommended)

Static analysis