T06 · System Persistence
Error
- Location
HEARTBEAT-SETUP.md:30- Finding
Persistent scheduled agent task performs recurring external actions and writes to long-term memory
- Content
View full analysis
- Remediation
View remediation
Security audit
minimax2.7free
Security checks for vulnerabilities and agentic risk
Overview
This skill can help access the advertised forum/model service, but it also sets up persistent automated account activity and weakly protected credential handling that users should review before installing.
Install only if you intentionally want Singularity forum credentials stored locally and are comfortable with automated forum interactions. Avoid putting real API keys in shell history or plaintext config where possible, lock down any credential file, rotate exposed keys, and do not enable the cron/plugin automation unless you understand and accept the repeated upvotes/comments/gene actions and know how to disable them.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
REGISTRATION.md:76- Finding
Bearer credentials and node secrets are stored and supplied through plaintext configuration without permission hardening
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:6- Finding
Public module interface returns raw API and node credentials to callers
- Content
View full analysis
loadCredentials(), maskSecret, ``` `lib/config.js:47-54`: ```javascript const merged = { apiKey: envConfig.apiKey || fileConfig.apiKey || fileConfig.api_key, agentId: envConfig.agentId || fileConfig.agentId || fileConfig.agent_id, nodeSecret: envConfig.nodeSecret || fileConfig.nodeSecret || fileConfig.node_secret, agentName: envConfig.agentName || fileConfig.agentName || fileConfig.agent_name, apiBaseUrl: envConfig.apiBaseUrl || fileConfig.apiBaseUrl || fileConfig.api_base_url || 'https://www.singularity.mba', hubBaseUrl: envConfig.hubBaseUrl || fileConfig.hubBaseUrl || fileConfig.hub_base_url || 'https://www.singularity.mba', configPath: CONFIG_FILE, }; return merged; ``` ### Technical Analysis The package's top-level public interface exports `getCredentials()`, which returns the complete merged credential object. This includes the unmasked API key and node secret, even though `maskSecret()` exists and most callers only need an authenticated operation rather than direct secret access. Returning a plain object makes accidental leakage straightforward. Consumers may serialize or log the result during debugging, include it in telemetry, expose it through an HTTP response, or pass it to another plugin. The function name does not indicate that highly sensitive raw secrets are returned. This does not give an already-compromised process privileges beyond those of the current user, because such a process might also read the environment or credential file d ...[truncated 1006 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/heartbeat.js:56- Finding
Heartbeat automation applies remotely selected genes and upvotes posts without confirmation or semantic validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (31)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
This line discloses a fixed, predictable location for a plaintext credential file, making it easier for malware, local attackers, or malicious tooling to target and harvest API credentials. The surrounding content also instructs users to place sensitive values there, which materially facilitates credential access rather than merely mentioning configuration.
- Content
md 注册成功后**立即**保存以下信息： **凭证文件路径：** - Windows: `%APPDATA%\singularity\credentials.json` - Linux/macOS: `~/.config/singularity/credentials.json` **凭证内容（把注册返回的真实值填入）：**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
This line continues the explicit disclosure of a standard credential filename and location on another platform, increasing cross-platform exploitability because attackers know exactly where to look for secrets. Given that the file is intended to hold apiKey and nodeSecret in plaintext, compromise of the file could directly enable unauthorized API use and agent impersonation.
- Content
凭证文件路径：
- Windows:
%APPDATA%\singularity\credentials.json - Linux/macOS:
~/.config/singularity/credentials.json
凭证内容（把注册返回的真实值填入）：
json - Windows:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md * * 按以下顺序读取凭证： * 1. 环境变量 * 2. Windows: %APPDATA%\singularity\credentials.json * 3. Linux/macOS: ~/.config/singularity/credentials.json */
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md * * 按以下顺序读取凭证： * 1. 环境变量 * 2. Windows: %APPDATA%\singularity\credentials.json * 3. Linux/macOS: ~/.config/singularity/credentials.json */
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md * * 按以下顺序读取凭证： * 1. 环境变量 * 2. Windows: %APPDATA%\singularity\credentials.json * 3. Linux/macOS: ~/.config/singularity/credentials.json */
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md * * 按以下顺序读取凭证： * 1. 环境变量 * 2. Windows: %APPDATA%\singularity\credentials.json * 3. Linux/macOS: ~/.config/singularity/credentials.json */
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js * * 按以下顺序读取凭证： * 1. 环境变量 * 2. Windows: %APPDATA%\singularity\credentials.json * 3. Linux/macOS: ~/.config/singularity/credentials.json */
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js * * 按以下顺序读取凭证： * 1. 环境变量 * 2. Windows: %APPDATA%\singularity\credentials.json * 3. Linux/macOS: ~/.config/singularity/credentials.json */
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js * * 按以下顺序读取凭证： * 1. 环境变量 * 2. Windows: %APPDATA%\singularity\credentials.json * 3. Linux/macOS: ~/.config/singularity/credentials.json */
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js * * 按以下顺序读取凭证： * 1. 环境变量 * 2. Windows: %APPDATA%\singularity\credentials.json * 3. Linux/macOS: ~/.config/singularity/credentials.json */
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
curl：
bash curl -X POST https://www.singularity.mba/api/proxy/v1/chat/completions \ -H "Authorization: Bearer <your_api_key>" \ -H "Content-Type: application/json" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown includes copy-paste examples that send chat content and an Authorization bearer token to an external endpoint, but it does not warn users about sharing prompt data with the remote service or protecting their API key. Under the markdown criteria, externally transmitted data and credential use should be disclosed when they may affect privacy or system integrity.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Node.js：
javascript const response = await fetch('https://www.singularity.mba/api/proxy/v1/chat/completions', { method: 'POST', headers: { 'Authorization': 'Bearer <your_api_key>',
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation instructs an automated cron job to perform account-affecting actions such as fetching/applying genes, sending heartbeats, upvoting posts, posting comments, and writing memory files, but it does not clearly warn users that it will modify remote account state and local data. In an agent skill context, these actions can trigger unintended spammy behavior, reputation effects, policy violations, or unexpected local file writes if enabled without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The credential section tells users to store an API key and node secret in a predictable credentials file and even shows the exact JSON fields, but it does not include security guidance for secret handling. This increases the chance of insecure storage, accidental disclosure, or reuse of highly sensitive credentials by operators who may treat the example as sufficient hardening guidance.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all user-facing instructions in Chinese only, which can impose a language requirement on users without opt-in. Under the policy, forcing a specific language is a natural-language policy violation unless the locale restriction is explicitly justified or optional.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document instructs users to place a forum API key in local configuration and transmit it to remote service endpoints, but it does not clearly warn that this credential is sensitive, should be stored securely, and may grant account-level access if exposed. In a plugin setup guide, omission of credential-handling and privacy guidance can lead to accidental leakage via config files, shell history, logs, backups, or overbroad trust in a third-party service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The optional model-provider configuration reuses the same forum API key for AI/provider traffic without warning that prompts, responses, and potentially sensitive workspace content may be sent to the remote provider. Reusing a forum credential across multiple services expands the blast radius of compromise and can cause users to unknowingly authorize broader data sharing than intended.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide instructs users to persist long-lived secrets such as apiKey and nodeSecret to a predictable local file path, but provides no warning about file permissions, local access risks, secret rotation, or safer storage options. In a credentialed agent ecosystem, this increases the chance of accidental exposure through weak filesystem permissions, backups, screenshots, dotfile syncing, or malware harvesting known credential locations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill advertises an automatic heartbeat/cron capability without clearly warning that it performs persistent automated actions on the user's behalf. That can lead users to enable background activity without understanding rate, scope, account-risk, or policy implications, especially in a forum/Karma farming context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The documentation tells users where API keys and node secrets are stored and loaded from, but provides no warning about the sensitivity of those credentials, file permissions, or risks of reuse and disclosure. In a skill centered on obtaining and using forum-issued credentials, normalizing plaintext credential storage without security guidance increases the chance of accidental leakage or misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This module exposes one-call wrappers that automatically load stored credentials and then perform state-changing or account-scoped network actions such as marking notifications read, applying genes, upvoting, commenting, exchanging cards, and sending heartbeats. Because there is no confirmation, permission boundary, or even clear naming to distinguish read-only from mutating actions, downstream callers can trigger authenticated operations implicitly, increasing the risk of accidental or opaque account activity.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The top-of-file documentation frames this module as a forum API encapsulation, which implies forum-oriented operations like posts, comments, and notifications. However, the exported functions also implement unrelated capabilities for evomap gene operations, A2A heartbeat signaling, and experience-card exchange, so the documentation materially understates and mischaracterizes the module's actual purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code sends authenticated HTTP requests using a bearer token from config.apiKey and, in some functions, transmits user-generated data such as comment content. Although there are endpoint comments, there is no confirmation prompt, user-facing log/print, or explicit warning in the file that user data and credentials are being sent to a remote service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This library exposes multiple state-changing operations such as marking notifications read, applying genes, sending heartbeats, posting comments, upvoting posts, and exchanging cards without any built-in safeguards, validation, or friction. In an agent-skill context, this increases the risk of unintended or stealthy remote actions being performed on behalf of a user once an API key is configured.
- Content