Security audit

Vinculum - Shared Consciousness

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real LAN sync skill, but it shares agent data through an unauthenticated plaintext relay while claiming encryption.

Review carefully before installing. Use this only on trusted private networks and assume shared memories, activity, decisions, messages, filenames, and status can be read or modified by anyone who can reach the relay or access relay storage/config. Do not share secrets through it, do not rely on the advertised encryption, restrict the relay with localhost/VPN/firewall rules, and prefer waiting for real client-side encryption, peer authentication, and dependency updates before using it with sensitive data.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/gun-adapter.js:58
Finding: Collective Data Is Stored and Transmitted Without the Advertised Encryption
Content: View full analysis
setTimeout(r, 50)); return entry; } async shareMemory(memoryData) { const entry = schema.createMemoryEntry({ learnedBy: this.agentName, ...memoryData }); this.node('memory', entry.id).put(entry); this.gun.get(this.key('memories')).set({ id: entry.id, learned_by: entry.learned_by, timestamp: entry.timestamp }); await new Promise(r => setTimeout(r, 50)); return entry; } async recordDecision(decisionData) { const entry = schema.createDecisionEntry({ decidedBy: this.agentName, ...decisionData }); this.node('decision', entry.id).put(entry); this.gun.get(this.key('decisions')).set({ id: entry.id, topic: entry.topic, timestamp: entry.timestamp }); ``` The schema confirms that plaintext content, context, filenames, identity information, and decisions are put into these records: ```js function createMemoryEntry({ content, learnedBy, co ...[truncated 2261 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/relay-simple.js:31
Finding: Unauthenticated Gun Relay Allows Unauthorized Reading, Writing, and Agent Impersonation
Content: View full analysis
{ if (req.url === '/health' || req.url === '/status') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ status: 'ok', uptime: process.uptime() * 1000, port: PORT })); return; } res.writeHead(200); res.end('Vinculum Relay'); }); // Use Gun's native server module - this properly handles WebSockets const Gun = require('gun'); require('gun/axe'); // Enable peer discovery const gun = Gun({ web: server, file: path.join(DATA_DIR, 'relay-data'), axe: true }); ``` The relay listens on every available network interface: ```js server.listen(PORT, '0.0.0.0', () => { fs.writeFileSync(PID_FILE, String(process.pid)); log(`Relay started on port ${PORT}`); log(`PID: ${process.pid}`); log(`Data: ${DATA_DIR}`); console.log(`Gun relay running on port ${PORT} (PID ${process.pid})`); }); ``` Agent records are written without a cryptographic identity or access-control check: ```js async registerAgent(agentInfo) { const identity = schema.createAgentIdentity(agentInfo); const status = schema.createAgentStatus({ online: true }); // Store agent identity (flat key) this.node('agent', this.agentId).put({ ...identity, ...status, type: 'agent' }); // Add to agents collection using set() this.gun.get(this.key('agents')).set({ id: this.agentId, name: agentInfo.name, added: Date.now() }); await new Promise(r => setTimeout(r, 100)); } ``` ### Technical Analysis The relay exposes Gun over a server bound to `0.0.0.0` and enables AXE peer discovery. The implementation does not configure: - Peer authentication - Gun S ...[truncated 1703 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/commands/relay.js:101
Finding: Remote Synchronization Accepts Plain HTTP Connections Without Transport Security
Content: View full analysis
:${port}/gun\`` ); ``` Remote peer validation only checks whether the supplied string begins with `http`: ```js async function addPeer(url, context) { const { configManager } = context; if (!url || !url.startsWith('http')) { return formatting.formatError( `Invalid peer URL. Must be http:// or https://\n\n` + `Example: \`/link relay peer http://192.168.1.100:8765/gun\`` ); } const config = await configManager.get(); const peers = config.peers || []; if (peers.includes(url)) { return formatting.formatWarning(`Peer already configured: ${url}`); } peers.push(url); await configManager.set({ peers }); ``` ### Technical Analysis The documented and generated multi-machine configuration uses `http://` rather than TLS-protected `https://` or `wss://`. Since the application-layer encryption key is not used to encrypt or authenticate records, transport traffic has no independent confidentiality or integrity protection. The validation is also not proper URL parsing. `startsWith('http')` accepts malformed or unexpected strings and does not enforce: - A specific protocol - A valid hostname or port - TLS for non-loopback destinations - Prohibiti ...[truncated 1086 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/index.js:54
Finding: Collective Secret Is Persisted Without Explicit Restrictive File Permissions
Content: View full analysis
`. 2. The namespace and collective key are serialized into ...[truncated 1059 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (35)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 86% confidence
Finding: The troubleshooting section recommends a destructive shell command using rm -rf to clear application data. Even though the path is scoped to the skill directory, README users may run it without understanding the consequences, and path mistakes, symlink abuse, or execution from an unexpected environment could result in unintended data loss.
Content: Scanner excerpt · README.md (reported line 376)May include surrounding context.
md
1. Reduce sync frequency: `/link config set syncInterval 10000` 2. Check for sync loops (two drones fighting over same file) 3. Restart relay: `/link relay stop` → `/link relay start` 4. Clear radata cache: `rm -rf skills/vinculum/radata/*` ### Problem: Conflicts in MEMORY.md

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · README.md (reported line 524)May include surrounding context.
md
- Use ESLint configuration - Follow existing patterns - Add tests for new features - Update SKILL.md for new commands ---

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: If the implementation does not actually provide the advertised synchronization, pairing, or encryption features, operators may rely on nonexistent protections and operational guarantees. While this is partly a product integrity issue, it becomes a security concern when users believe sensitive collective data is protected or shared only in constrained ways when that is not true.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: If the implementation does not actually provide the advertised synchronization, pairing, or encryption features, operators may rely on nonexistent protections and operational guarantees. While this is partly a product integrity issue, it becomes a security concern when users believe sensitive collective data is protected or shared only in constrained ways when that is not true.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: If the implementation does not actually provide the advertised synchronization, pairing, or encryption features, operators may rely on nonexistent protections and operational guarantees. While this is partly a product integrity issue, it becomes a security concern when users believe sensitive collective data is protected or shared only in constrained ways when that is not true.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation does not actually provide the advertised synchronization, pairing, or encryption features, operators may rely on nonexistent protections and operational guarantees. While this is partly a product integrity issue, it becomes a security concern when users believe sensitive collective data is protected or shared only in constrained ways when that is not true.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Although the top-level link is disabled by default, the configuration pre-enables automatic syncing, relay auto-start, and multicast discovery once enabled, without any explicit warning, consent gate, or trust boundary controls. In the context of a P2P 'shared consciousness' feature over the local network, this increases the chance of accidental network exposure, automatic peer discovery, and uncontrolled propagation of shared data to unintended systems.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The lockfile includes gun's nested dependency ws 7.5.10, which is flagged for a memory exhaustion denial-of-service issue from fragmented frames. Because this skill explicitly links bots over the local network using Gun.js P2P sync, it likely exposes a WebSocket-facing surface where a peer or attacker on the reachable network could crash or degrade relay/agent availability.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The top-level dependency ws 8.19.0 is identified with advisories for both uninitialized memory disclosure and memory exhaustion DoS. In this skill's context, real-time peer-to-peer synchronization over the local network increases risk because malformed or hostile WebSocket traffic could leak process memory contents or exhaust resources across connected bot instances.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The dependency specification ^8.18.0 for ws can resolve to ws 8.19.0, which the finding identifies as containing vulnerabilities including memory disclosure and memory-exhaustion denial of service. This is especially relevant here because the skill's purpose is real-time local-network peer synchronization over WebSockets, increasing exposure to malformed or attacker-controlled traffic.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README prominently markets 'shared memories, activities, and decisions' across bots and machines, but it does not place a strong upfront warning that local bot data will be replicated and persisted on other systems in the collective. In a tool explicitly designed to sync agent memory and logs, users may unintentionally expose sensitive prompts, notes, or operational data to every joined node.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation encourages adding arbitrary paths to syncPaths and explicitly states that non-markdown and binary files can be synced, but it does not adequately warn that this can replicate secrets, credentials, or unrelated private local files across the network. Because this feature broadens data-sharing scope beyond expected memory files, it materially increases the risk of accidental exfiltration within the collective.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 76% confidence
Finding: The skill metadata defines shell-based installation and implies environment-dependent execution, but it does not declare any explicit tool scope or permissions boundary. That makes the trust model unclear and increases the chance of unintended access to host environment data or execution capabilities during install/use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly promotes sharing memories, activities, and decisions across bots, but it does not give a clear warning that this may include sensitive prompts, derived secrets, operational context, or private data. In a multi-agent environment, that omission can lead to accidental lateral disclosure across machines or users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The quick-start flow encourages starting a relay and linking additional bots over the network without an explicit warning about multicast discovery, host visibility, and cross-machine data propagation. Users may enable network sharing immediately, before understanding that other systems on the LAN could discover or interact with the service depending on configuration.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The configuration shares broad categories like activity, memory, and decisions without defining scope, redaction rules, sensitivity limits, or exclusions. In a skill explicitly designed to link multiple bots and share state in real time, this can cause unintended disclosure of prompts, secrets, internal reasoning artifacts, or user-derived data across peers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The /link share command transmits arbitrary user-provided text onto a peer-to-peer network immediately after basic non-empty validation, with no explicit warning, confirmation, or opportunity to review what will be shared. In a skill whose core purpose is cross-instance memory and decision sharing, this creates a real risk of accidental disclosure of sensitive prompts, secrets, internal notes, or personal data to other connected peers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code persists the network encryption key directly into configuration, creating a durable local secret that may be exposed through config file reads, backups, logs, or other local integrations. In this skill's context, that key grants access to a shared multi-bot namespace where participants can read and write collective memory, so compromise of the stored key can let an attacker join the network and tamper with or exfiltrate shared context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The join command persists the namespace identifier and encryption key directly into long-lived configuration as soon as a pairing code is accepted. In a skill whose purpose is to link multiple bot instances and share memories and decisions in real time, storing these credentials without explicit confirmation, scoping, or mention of secure storage increases the risk that anyone with config access can silently rejoin the collective or exfiltrate the shared-network secret.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Starting the relay advertises that multicast is enabled and provides a LAN-accessible URL, but the command output does not present a clear security warning, consent step, or restriction before exposing the service to other devices on the local network. In a skill explicitly designed to share memories, activities, and decisions between bots, silent LAN exposure increases the chance of unintended access, data leakage, or peer connections from untrusted hosts on the same network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The adapter connects agents into a shared Gun.js network and immediately registers the agent, starts syncing status, and exposes methods for sharing memories, activities, decisions, and messages without any user-facing disclosure or consent mechanism. In the context of a 'shared consciousness' skill that propagates potentially sensitive context across peers, silent network sharing can cause unanticipated disclosure of agent state, memory, and operational data to other local-network participants.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill is designed to share bot activity, memory, decisions, and status across the network, and this file performs that sharing without any user-facing disclosure or per-category consent checks beyond config flags. In the context of a 'shared consciousness' skill, this is especially sensitive because these data types can contain prompts, operational details, user content, or secrets, so silent synchronization materially increases privacy and data-leak risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill contains code to start a detached background relay process automatically, which expands its capabilities beyond passive in-process bot linking into persistent local process management. Even if the relay is part of the intended sync architecture, silently spawning a daemonized process increases attack surface, persistence, and operational surprise, especially in environments where users did not explicitly approve background services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code auto-starts a detached relay subprocess with no interactive confirmation or visible disclosure in this file, so users may unknowingly end up running a background network service. That is risky because it creates unintended persistence and a listening component that could expose data or be abused in multi-user or shared-host environments.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The daemon explicitly listens on 0.0.0.0, exposing the HTTP/Gun relay to every reachable interface rather than limiting it to loopback or a tightly scoped local-peer boundary. In the context of a memory/activity sync service, this increases the attack surface for unauthorized access, data tampering, or abuse of the relay by any host that can reach the port.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/commands/relay.js:84

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/index.js:168