Vinculum - Shared Consciousness

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:33 AM UTC
• Version: 1.2.0

Overview

Vinculum appears purpose-built for sharing bot memory across a local network, but its security claims and network protections are weaker than the artifacts suggest.

Install only if you intentionally want trusted Clawdbot instances on a private network to share memory, activity, decisions, status, and manual notes. Treat pairing codes and the local config as sensitive, avoid public or untrusted networks, stop the relay when not needed, and do not rely on the advertised encryption until the implementation is fixed or independently verified.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill metadata invokes shell installation commands using environment variables such as $SKILL_DIR, which indicates code capabilities are present, yet no corresponding permissions are declared. This creates a transparency and trust problem: users and hosting platforms cannot accurately assess what execution context the skill requires or restrict it appropriately.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The adapter advertises that it handles encryption, but all shared memories, activities, decisions, and messages are written to Gun in plaintext and the provided encryption key is never used. In a skill explicitly designed to share real-time agent memories and decisions across a local network, this creates a strong risk of unintended disclosure, unauthorized observation, and false operator assumptions about confidentiality.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill contains code to spawn a detached local relay process via child_process.spawn(), which creates a persistent background service outside the immediate command flow. Even if intended to support local P2P sync, silently creating a long-lived process expands the skill's capabilities and attack surface, and can be abused for persistence or unexpected network exposure if configuration is altered or the relay script is compromised.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The relay explicitly listens on 0.0.0.0, exposing the HTTP/Gun service on every network interface rather than restricting it to loopback or a clearly bounded local-only transport. In the context of a skill that shares memories and decisions between bot instances, this broad exposure can allow unintended hosts on reachable networks to connect, observe metadata, and potentially participate in sync traffic if Gun is not otherwise authenticated or segmented.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README strongly promotes a 'shared consciousness' and instant synchronization of MEMORY.md and other files, but it does not prominently warn at the start that local bot data will be replicated across machines and may overwrite or propagate unintended state. In a skill whose core function is cross-machine file synchronization, insufficient up-front disclosure can cause accidental leakage of sensitive data and destructive sync behavior by users who do not fully understand the consequences.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation encourages users to expand syncPaths, including broad globs like projects/**/*.md, without prominently warning that doing so can replicate sensitive workspace data, secrets in markdown, or operational files to every peer in the collective. Because this skill is designed to spread content automatically across multiple machines, permissive sync-path guidance materially increases the risk of accidental data exposure and unintended propagation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This skill is specifically designed to share activity, memories, and decisions across bots over a network, but the description does not present a prominent user warning about the privacy and security implications. In this context, weak disclosure is dangerous because operators may enable collective sync without understanding that sensitive operational data could propagate to other machines or peers.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The default configuration enables sharing of activity, memory, and decisions, which are highly sensitive data categories, while the skill’s purpose is explicit real-time synchronization across multiple bots on the local network. Although the top-level feature flag is disabled by default, these permissive share defaults combined with relay auto-start and multicast discovery increase the chance that once enabled, operators unintentionally expose more data than intended.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The command transmits arbitrary user-provided text to other linked bot instances immediately, without any warning, confirmation, or guardrail about network propagation. In a skill explicitly designed to share memories, activities, and decisions in real time across a local network, this increases the chance of accidental disclosure of sensitive prompts, secrets, internal notes, or operator data to multiple peers.

Missing User Warnings

High

• Confidence: 92% confidence
• Finding: The destroy command immediately disconnects and clears local configuration, including the namespace and encryption key, without any confirmation, safety interlock, or visible authorization check in this code path. In a shared-bot, networked synchronization skill, a mistaken invocation or unauthorized trigger could disrupt coordination, sever access to the shared network, and cause operational denial of service for the local instance.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code persists the namespace encryption key directly into configuration storage without any indication to the user that a long-lived secret is being stored locally. In the context of this skill, that key grants read/write access to the shared collective state, so compromise of config files, backups, logs, or local disk access could expose the entire shared network to unauthorized participants.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The connect/register flow begins synchronizing agent identity and later enables sharing of activities, memories, decisions, and messages over the network without any user-facing disclosure or consent checkpoint. In this skill's context of linking multiple bots into a collective consciousness, silent background propagation materially increases privacy and data-governance risk because sensitive agent context may be exposed beyond the local instance without the operator clearly realizing it.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code automatically launches a detached Node.js subprocess without any user-facing confirmation, notification, or consent. This is dangerous because it can create hidden background execution and persistence characteristics that users do not expect from a state-sharing skill, making misuse or unnoticed operation more likely.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: When enabled, the skill automatically connects to peers and shares metadata such as name, instanceId, owner, and channel, but this file provides no user-facing disclosure or consent mechanism around that networked data sharing. In a bot skill that synchronizes memories, activities, and decisions, lack of disclosure materially increases the risk of unintended sensitive-data exposure across the local network or configured peers.

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: ws==8.18.0

Known Vulnerable Dependency: yaml==2.8.2 — 1 advisory(ies): CVE-2026-33532 (yaml is vulnerable to Stack Overflow via deeply nested YAML collections)

Low

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: yaml==2.8.2

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/commands/relay.js:84

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/index.js:168