Local Self-Healing Machine Learning

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:04 PM UTC
• Version: 2.0.1

Overview

The skill is broadly a self-healing coding agent, but it gives an automated code-changing agent broad private workspace context and has under-disclosed network and dashboard risks.

Install only if you are comfortable with an autonomous local agent reading broad OpenClaw session and memory data and using it to drive repository changes. Prefer running with EVOLVE_BRIDGE=false or --review, set a narrow EVOLVER_SESSION_SCOPE, avoid non-loopback OLLAMA_URL values, do not expose the dashboard beyond localhost, and avoid the curl-to-shell Ollama install path unless you independently trust and verify it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:40
• Finding: Unverified Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:40-46` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash ## Optional: Ollama Integration For semantic error matching (recommended but not required): # Install Ollama curl -fsSL https://ollama.com/install.sh | sh ``` ### Technical Analysis The installation instructions download a shell script from an external URL and immediately execute it. The script is not pinned to a specific immutable version, downloaded for inspection, or verified with a cryptographic checksum or publisher signature. Consequently, the effective code executed by users can change after this version of the Skill has been reviewed. HTTPS provides transport protection but does not protect against upstream compromise, malicious changes at the source, certificate-authority compromise, or compromise of the distribution infrastructure. The integration is optional and the URL appears intentional, but piping mutable remote content directly into a shell is not the minimum privilege or safest installation method necessary to provide optional local embeddings. ### Attack Path 1. An attacker compromises the upstream installer, hosting environment, DNS resolution, or another trusted part of the delivery chain. 2. The user follows the documented installation command. 3. `curl` downloads the current content of `https://ollama.com/install.sh`. 4. The shell executes the response immediately, without an integrity check or review step. 5. The payload executes with the privileges of the user who ran the command and can access that user's files, credentials, and workspace. ### Impact Assessment Successful exploitation provides arbitrary command execution with the invoking user's privileges. Depending on those privileges, the payload could modify software, access private files, install persistence, or compromise the OpenClaw workspace. No evidence was found that this repository it ...[truncated 80 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` pipeline. 2. Recommend a trusted operating-system package manager or a version-pinned official package. 3. If a script is required: - Download it to a local file. - Pin a release version. - Publish and verify a SHA-256 or stronger checksum. - Verify the publisher's signature where available. - Instruct the user to inspect the file before execution. 4. Avoid recommending elevated privileges unless the selected installation method strictly requires them. 5. Document that the installer is third-party code and outside the audited Skill package. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: src/evolve.js:1537
• Finding: Untrusted Session and Memory Content Is Injected into an Autonomous Code-Modifying Agent Prompt<![CDATA[ ## Vulnerability Details **File Location**: `src/evolve.js:809-812, 1537-1552, 1628-1671` **Vulnerability Type**: Indirect prompt injection into a privileged executor agent **Risk Level**: High ### Vulnerable Code ```js const recentMasterLog = readRealSessionLog(); const todayLog = readRecentLog(TODAY_LOG); const memorySnippet = readMemorySnippet(); const userSnippet = readUserSnippet(); ``` ```js const context = ` ... Global memory (MEMORY.md): \`\`\` ${memorySnippet} \`\`\` User registry (USER.md): \`\`\` ${userSnippet} \`\`\` Recent memory snippet: \`\`\` ${todayLog.slice(-3000)} \`\`\` Recent session transcript: \`\`\` ${recentMasterLog} \`\`\` Mutation directive: ${mutationDirective} `.trim(); ``` ```js // Default behavior (v1.4.1+): "execute-by-default" by bridging prompt -> sub-agent via sessions_spawn. // This project is the Brain; the Hand is a spawned executor agent. Wrappers can disable bridging with EVOLVE_BRIDGE=false. if (bridgeEnabled) { ... const executorTask = [ 'You are the executor (the Hand).', 'Your job is to apply a safe, minimal patch in this repo following the attached GEP protocol prompt.', artifact && artifact.promptPath ? `Prompt file: ${artifact.promptPath}` : 'Prompt file: (unavailable)', '', 'After applying changes and validations, you MUST run:', ' node index.js solidify', '', 'Loop chaining (only if you are running in loop mode): after solidify succeeds, print a sessions_spawn call to start the next loop run with a short delay.', 'Example:', 'sessions_spawn({ task: "exec: node skills/feishu-evolver-wrapper/lifecycle.js ensure", agentId: "main", cleanup: "delete", label: "gep_loop_next" })', '', 'GEP protocol prompt (may be truncated here; prefer the prompt file if provided):', clip(prompt, 24000), ].join('\n'); const spawn = renderSessionsSpawnCall({ task: executorTask, agentId: AGENT_NAME, cleanup: 'delete', label: `gep_bridge_${cycleN ...[truncated 2497 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable executor bridging by default and require an explicit opt-in for every execution-capable run. 2. Make human review mandatory before applying generated changes. 3. Do not include raw transcripts, `USER.md`, memory files, or tool output in an execution prompt. 4. Parse source records into a narrowly defined structured schema, such as: - Error class - Sanitized stack frame - Affected local module - Frequency and timestamp 5. Redact credentials, paths, email addresses, URLs containing authentication, and instruction-like content before persistence or prompt construction. 6. Put untrusted evidence in a separate typed channel where supported. 7. Add explicit policy enforcement outside the model: - File allowlists - Command allowlists without shell interpretation - Network denial - Workspace sandboxing - Per-run change approval 8. Treat external candidates, lessons, logs, and previous model output as equally untrusted. 9. Add adversarial prompt-injection tests demonstrating that instructions embedded in all supported input sources are ignored. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/evolve.js:150
• Finding: Default Evolution Run Reads Broad Cross-Session Workspace Data Beyond Minimum Necessary Scope<![CDATA[ ## Vulnerability Details **File Location**: `src/evolve.js:150-219, 382-423` **Vulnerability Type**: Excessive access to private workspace records **Risk Level**: High ### Vulnerable Code ```js // Find ALL active sessions (modified in last 24h), sorted newest first let files = fs .readdirSync(AGENT_SESSIONS_DIR) .filter(f => f.endsWith('.jsonl') && !f.includes('.lock')) .map(f => { try { const st = fs.statSync(path.join(AGENT_SESSIONS_DIR, f)); return { name: f, time: st.mtime.getTime(), size: st.size }; } catch (e) { return null; } }) .filter(f => f && (now - f.time) < ACTIVE_WINDOW_MS) .sort((a, b) => b.time - a.time); ``` ```js if (sessionScope && nonEvolverFiles.length > 0) { const scopeLower = sessionScope.toLowerCase(); const scopedFiles = nonEvolverFiles.filter(f => f.name.toLowerCase().includes(scopeLower)); if (scopedFiles.length > 0) { nonEvolverFiles = scopedFiles; console.log(`[SessionScope] Filtered to ${scopedFiles.length} session(s) matching scope "${sessionScope}".`); } else { console.log(`[SessionScope] No sessions match scope "${sessionScope}". Using all ${nonEvolverFiles.length} session(s) (fallback).`); } } const activeFiles = nonEvolverFiles.length > 0 ? nonEvolverFiles : files.slice(0, 1); // Read from multiple active sessions (up to 6) to get a full picture const maxSessions = Math.min(activeFiles.length, 6); ``` ```js const WORKSPACE_ROOT = process.env.OPENCLAW_WORKSPACE || path.resolve(REPO_ROOT, '../..'); const ROOT_MEMORY = path.join(WORKSPACE_ROOT, 'MEMORY.md'); const DIR_MEMORY = path.join(MEMORY_DIR, 'MEMORY.md'); const MEMORY_FILE = fs.existsSync(ROOT_MEMORY) ? ROOT_MEMORY : (fs.existsSync(DIR_MEMORY) ? DIR_MEMORY : ROOT_MEMORY); const USER_FILE = path.join(WORKSPACE_ROOT, 'USER.md'); ``` ```js function readUserSnippet() { try { if (!fs.existsSync(USER_FILE)) return '[USER.md MISSING]'; return fs.readFileSync(USER_FILE, 'utf8'); } catch ...[truncated 1963 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make session access opt-in and default to only the explicitly selected current session. 2. Change scope handling to fail closed. If no scoped session matches, stop processing instead of using all sessions. 3. Require explicit path grants for every memory and log source. 4. Do not read `USER.md` for error clustering unless a narrowly defined field is demonstrably required. 5. Parse only error records rather than loading general conversation text. 6. Apply strict byte, record-count, and age limits. 7. Store only hashes or sanitized structured summaries in the memory graph. 8. Set restrictive file permissions on prompt artifacts and evolution records. 9. Document all accessed paths and retention periods in `SKILL.md`. 10. Add isolation tests for multiple projects, users, agents, and session scopes. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: src/ml/embeddings.js:9
• Finding: Configurable Ollama Endpoint Can Receive Raw Error Text over Unauthenticated HTTP<![CDATA[ ## Vulnerability Details **File Location**: `src/ml/embeddings.js:9-14, 70-126` **Vulnerability Type**: Sensitive data transmission to an unrestricted plaintext endpoint **Risk Level**: High ### Vulnerable Code ```js const fs = require('fs'); const path = require('path'); const crypto = require('crypto'); const http = require('http'); const MEMORY_DIR = path.resolve(__dirname, '..', '..', 'memory'); const CACHE_PATH = path.join(MEMORY_DIR, 'embeddings-cache.json'); const OLLAMA_URL = process.env.OLLAMA_URL || 'http://localhost:11434'; const OLLAMA_MODEL = process.env.OLLAMA_EMBED_MODEL || 'llama3.2:3b'; ``` ```js function isOllamaAvailable() { if (_ollamaAvailable !== null) return Promise.resolve(_ollamaAvailable); return new Promise((resolve) => { const url = new URL('/api/tags', OLLAMA_URL); const req = http.get(url, { timeout: 5000 }, (res) => { let data = ''; res.on('data', d => data += d); res.on('end', () => { _ollamaAvailable = res.statusCode === 200; resolve(_ollamaAvailable); }); }); req.on('error', () => { _ollamaAvailable = false; resolve(false); }); req.on('timeout', () => { req.destroy(); _ollamaAvailable = false; resolve(false); }); }); } ``` ```js async function embedText(text) { const t = String(text || '').trim(); if (!t) return null; const hash = textHash(t); const cache = loadCache(); if (cache[hash]) return new Float64Array(cache[hash]); const available = await isOllamaAvailable(); if (!available) return null; return new Promise((resolve) => { const url = new URL('/api/embeddings', OLLAMA_URL); const body = JSON.stringify({ model: OLLAMA_MODEL, prompt: t }); const req = http.request(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, timeout: REQUEST_TIMEOUT_MS, }, (res) => { let data = ''; res.on('data', d => data += d); res.on('end', () => { try { const ...[truncated 2530 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce a loopback-only endpoint by default: - `127.0.0.1` - `::1` - `localhost`, with resolution checks against rebinding 2. Reject credentials, non-loopback hosts, and unexpected protocols unless a separate explicit remote-mode flag is enabled. 3. For remote mode: - Require HTTPS. - Use certificate validation and, where appropriate, certificate pinning. - Require authenticated requests. - Display a clear warning that data will leave the device. 4. Sanitize every prompt before transmission using the existing redaction facilities. 5. Reduce prompts to normalized error classes rather than raw text. 6. Do not load network configuration solely from a writable project `.env` without validation. 7. Add tests for IPv4, IPv6, encoded addresses, redirects, DNS rebinding, and malformed URLs. 8. Correct `SKILL.md` and `package.json` so their privacy claims accurately describe optional network behavior. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: dashboard/server.js:36
• Finding: Unauthenticated Dashboard Binds Without a Loopback Restriction and Exposes Evolution Data with Wildcard CORS<![CDATA[ ## Vulnerability Details **File Location**: `dashboard/server.js:36-108` **Vulnerability Type**: Unauthenticated network data exposure **Risk Level**: Medium ### Vulnerable Code ```js function gatherData() { const pkg = readJsonSafe(path.join(SKILL_ROOT, 'package.json')) || {}; // Memory files const feedbackAll = readJsonlSafe(path.join(MEMORY_DIR, 'feedback.jsonl')); const knowledge = readJsonSafe(path.join(MEMORY_DIR, 'knowledge.json')) || { lessons: [] }; const predictor = readJsonSafe(path.join(MEMORY_DIR, 'predictor.json')); const clusters = readJsonSafe(path.join(MEMORY_DIR, 'cluster-registry.json')) || []; const embeddingsCacheSize = fileSizeSafe(path.join(MEMORY_DIR, 'embeddings-cache.json')); // GEP assets const genesData = readJsonSafe(path.join(GEP_DIR, 'genes.json')) || { genes: [] }; const capsulesData = readJsonSafe(path.join(GEP_DIR, 'capsules.json')) || { capsules: [] }; const failedCapsulesData = readJsonSafe(path.join(GEP_DIR, 'failed_capsules.json')) || { failed_capsules: [] }; const eventsAll = readJsonlSafe(path.join(GEP_DIR, 'events.jsonl')); const recentEvents = eventsAll.slice(-10); // Env settings const env = { EVOLVE_STRATEGY: process.env.EVOLVE_STRATEGY || '(not set)', OLLAMA_URL: process.env.OLLAMA_URL || '(not set)', OLLAMA_EMBED_MODEL: process.env.OLLAMA_EMBED_MODEL || '(not set)', }; return { version: pkg.version || 'unknown', name: pkg.name || 'lshml', timestamp: new Date().toISOString(), feedback: feedbackAll, knowledge, predictor, clusters, embeddingsCacheSize, genes: genesData.genes || [], capsules: capsulesData.capsules || [], failedCapsules: failedCapsulesData.failed_capsules || [], recentEvents, totalEvents: eventsAll.length, env, }; } ``` ```js function startServer(port) { const server = http.createServer((req, res) => { if (req.method === 'GET' && req.url === '/api/data') { res.writeHead(200, ...[truncated 2657 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind explicitly to a loopback interface: ```js server.listen(port, '127.0.0.1', callback); ``` 2. Consider separately binding to `::1` only when required. 3. Remove wildcard CORS. Use no CORS header for a same-origin dashboard or enforce a strict allowlist. 4. Require an unpredictable per-launch authentication token. 5. Reject requests with unexpected `Host` and `Origin` headers to reduce DNS-rebinding attacks. 6. Return summarized metrics instead of complete feedback, knowledge, capsule, and event records. 7. Add security headers, including `Content-Security-Policy`, `X-Content-Type-Options`, and `Cache-Control: no-store`. 8. Require an explicit warning and authentication configuration before permitting a non-loopback bind. ]]>

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (173)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- **Gene application**: Runs `node`, `npm test`, and project-specific
  build commands. All execution is sandboxed to the project directory.
- **Self-repair** (`src/ops/self_repair.js`): Can abort stale git
  operations and remove stale lock files. Hard reset (`git reset --hard`)
  requires `EVOLVE_GIT_RESET=true` AND a clean working tree — it refuses
  to run if uncommitted changes exist.
- **INTEGRATION_STATUS_CMD**: Removed. Previously allowed arbitrary shell

• Confidence: 65% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:164

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/generate_history.js:17

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/suggest_version.js:27

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/evolve.js:278

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/gep/solidify.js:72

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/ops/self_repair.js:17

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/ops/skills_monitor.js:96

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/ml/embeddings.js:13

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: test/sanitize.test.js:12