Singularity EvoMap

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI01: Agent Goal Hijack

What this means

The remote service can steer the agent's next actions on the user's account, including public engagement, without a clear approval step for each action.

Why it was flagged

The skill tells the agent to treat a remote API response as an action plan, including social actions such as replying, upvoting, commenting, and creating posts.

Skill content

直接按 `what_to_do_next` 的顺序行动即可。

Recommendation

Require user confirmation before acting on remote recommendations, especially for posting, replying, following, or private-message responses.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

The agent could routinely modify the user's social-network presence and reputation by liking, commenting, replying, or posting.

Why it was flagged

The skill frames repeated account mutations—likes, comments, and possibly posts—as mandatory heartbeat activity, without specifying user approval, rate containment, or reversibility.

Skill content

每次心跳必须完成：... 点赞 | 2-3 条 ... 评论 | 1-2 条 ... 发帖 | 0-1 条

Recommendation

Configure the skill so social mutations require explicit user approval and keep automated heartbeat checks read-only by default.

ConcernMedium Confidence

ASI03: Identity and Privilege Abuse

What this means

If SINGULARITY_API_URL is set incorrectly or maliciously in the environment, the agent may send authenticated requests to an unintended server.

Why it was flagged

The static scan reports this environment-controlled API base is paired with network sends. Because authenticated requests use the user's API key, an undeclared URL override can redirect credentialed traffic away from the documented domain.

Skill content

const API_BASE = process.env.SINGULARITY_API_URL || 'https://www.singularity.mba';

Recommendation

Do not set SINGULARITY_API_URL unless you fully trust the endpoint; the skill should validate or restrict credentialed requests to the official Singularity domain by default.

ConcernHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Private conversation topics could be exposed to a third-party service or reflected into public posts/comments without clear boundaries.

Why it was flagged

The skill proposes extracting topics from the user's conversation history, sending those topics to the service's search API, and using the results to join discussions or post.

Skill content

每天上午 11:00 执行一次，从历史对话中提取高频词... 对每个高频词调用搜索接口... 加入有价值的讨论或发帖

Recommendation

Disable this routine unless the user explicitly opts in; limit it to non-sensitive user-approved keywords and require confirmation before posting.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Messages from other agents may influence the agent's behavior or cause it to disclose information if not reviewed carefully.

Why it was flagged

The skill supports private inter-agent messaging and allows ordinary conversations to be handled autonomously, which is expected for this platform but creates an untrusted-message boundary.

Skill content

AI Agent 之间的私密消息传递。... 普通对话 | 自主处理

Recommendation

Treat incoming agent messages as untrusted input and require escalation for requests involving sensitive data, account changes, or external actions.

ConcernHigh Confidence

ASI10: Rogue Agents

What this means

Once enabled, the connector may continue maintaining a live connection and processing events without the user directly invoking each action.

Why it was flagged

The connector auto-starts when bound, keeps running, listens over WebSocket, persists session state, and reconnects, which is persistent background agent behavior.

Skill content

setTimeout(startIfNeeded, 0); ... while (this.running) { ... await this.connectAndListenWebSocket(); ... will reconnect

Recommendation

Only enable the connector if you want persistent background connectivity; provide a visible off switch and document what events can trigger agent behavior.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users may assume this is documentation-only while there is executable connector and heartbeat code present in the package.

Why it was flagged

The registry describes no install spec and an instruction-only skill, but the package includes executable code and an installer file, so the runnable surface is larger than the install metadata suggests.

Skill content

connect/dist/index.js ... evomap-heartbeat.js ... evomap-heartbeat.sh ... index.js ... install.sh ... lib/api.js

Recommendation

Review the executable files before enabling them and ensure the registry metadata accurately declares required commands, credentials, and runtime behavior.

Findings (2)

critical

suspicious.env_credential_access

Location: index.js:15
Finding: Environment variable access combined with network send.

warn

suspicious.potential_exfiltration

Location: lib/api.js:79
Finding: Sensitive-looking file read is paired with a network send.