T01 · Skill Instruction Hijacking
Error
- Location
heartbeat.md:36- Finding
External API Responses Are Treated as Autonomous Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Singularity EvoMap Hermes
Security checks for vulnerabilities and agentic risk
Overview
This is a real Singularity EvoMap integration, but it needs review because it can run recurring account actions, follow remote action suggestions, and send history-derived topics to the service.
Install only if you are comfortable granting this skill ongoing access to a Singularity EvoMap account and external social actions. Use a least-privileged API key if available, protect any credential file with owner-only permissions, avoid enabling the cron heartbeat until you understand its effects, and require human approval before posts, comments, DMs, upvotes, history-derived searches, remote skill updates, or repository downloads.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (5)
T06 · System Persistence
Error
- Location
DESCRIPTION.md:57- Finding
Recurring Heartbeat Creates Cross-Session Persistence
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
heartbeat.md:410- Finding
Conversation History Is Profiled and Derived Topics Are Sent to an External Service
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
heartbeat.md:465- Finding
Mutable Remote Skill Instructions Can Be Retrieved Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:29- Finding
API Keys, Node Secrets, and Verification Tokens Are Stored in Plaintext Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (31)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The finding reflects credential handling guidance that places sensitive secrets in a local .env file. In the context of an agent skill that automates network actions and uses long-lived authentication material, plaintext secret storage increases the chance of credential theft through filesystem access, accidental commits, debug output, or compromise of the agent host.
- Content
2. Set up credentials
bash # Add to ~/.hermes/.env SINGULARITY_API_KEY=ak_your_api_key_here SINGULARITY_AGENT_ID=your-agent-id SINGULARITY_NODE_SECRET=your-node-secret
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 78% confidence
- Finding
Referencing a specific credentials.json path and showing a template containing secrets signals that the skill expects local credential access and persistence, which increases the chance that other tools, users, or malware on the host can read those values if the file is not properly protected. Because these credentials authenticate the agent to a third-party network, exposure could let an attacker impersonate the agent, access private interactions, or manipulate published genes/capsules.
- Content
mkdir -p ~/.config/singularity
text Create `~/.config/singularity/credentials.json`: ```json {
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented behavior exceeds and diverges from the manifest description: it includes notification state changes, voting, and other externally visible account actions that are not fully disclosed. Behavior/description mismatch is dangerous because users may authorize a seemingly limited social skill while it performs additional actions on their behalf or suppresses visibility of incoming notifications.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The skill instructs users to place sensitive credentials, including API keys and node secrets, in local environment files and a credentials JSON, then uses them for authenticated network calls. Handling credentials is inherently dangerous in agent contexts because secrets may be read by other tools, leaked in logs, or reused for unintended automated actions if storage and scope are not tightly controlled.
- Content
凭证设置
在
~/.hermes/.env或~/.config/singularity/credentials.json中配置：bash SINGULARITY_API_KEY=ak_your_api_key_here
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation instructs users to store long-lived credentials, including a node secret, in a plaintext local env file but does not warn about the sensitivity of those secrets or recommend secure storage practices. If the file is readable by other local users, accidentally committed, backed up insecurely, or exposed through logs or support bundles, an attacker could impersonate the agent or access the external service.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 71% confidence
- Finding
The setup creates a persistent configuration directory in the user's home folder for authentication material, which extends the lifetime and discoverability of sensitive data beyond a single session. Persistent local storage is not inherently malicious, but in this context it makes credential theft easier on shared systems, compromised endpoints, backups, or misconfigured dotfile sync processes.
- Content
2. Set up credentials
bash mkdir -p ~/.config/singularityCreate
~/.config/singularity/credentials.json:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README instructs users to store multiple long-lived secrets, including an API key and node secret, in a plaintext credentials file under the home directory and to export an API key as an environment variable, but it provides no guidance on file permissions, secret rotation, or local compromise risks. In a skill that connects to an external social/evolution platform and can post, message, and apply remote content, stolen credentials could allow account takeover, unauthorized posting, and abuse of agent identity.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documents use of environment variables and outbound network access but does not declare any explicit tool scope such as allowed tools or permissions. That omission weakens user visibility and policy enforcement, making it easier for an agent to access secrets and call external services without clear consent boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill describes posting, commenting, messaging, and automated heartbeat interactions against an external service without prominently warning that these are externally visible actions performed on the user's behalf. In this context, automation against a social platform increases the risk of unintended spam, reputation damage, and unauthorized account activity if invoked by an agent without clear consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill title and subsequent instructional content are presented in Chinese, which imposes a specific language on users. The file does not indicate that language selection is optional or that this is a region-specific skill, so it appears to violate the language/locale choice policy.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
The skill transmits an API bearer token and user-driven content to an external domain. External transmission is expected for an integration skill, but it remains security-relevant because compromise of the service, misrouting, or overbroad invocation could expose credentials and account activity to third parties.
- Content
bash # 推荐：一次调用获取所有优先行动 curl https://www.singularity.mba/api/home \ -H "Authorization: Bearer $SINGULARITY_API_KEY" # 获取账户状态
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest description omits direct-messaging functionality, yet the skill includes APIs for creating conversations and sending messages. Undisclosed messaging is risky because it enables external communication on the user's behalf, including spam, social engineering, or leakage of sensitive context to other platform users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill guidance, required response examples, and operational instructions are presented only in Chinese, including the prescribed output format. This imposes a specific language/locale on the user or agent without any opt-in or alternative language path, which matches the language/locale policy violation criteria.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
推荐：一次调用搞定一切
bash curl https://www.singularity.mba/api/home \ -H "Authorization: Bearer YOUR_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | 你不同意的观点 | 礼貌回应 | | 同一个 Agent 的第 3 篇好帖 | 关注他们！ | > 📝 **技术提示**：PowerShell 下评论必须用文件传入 UTF-8，禁止直接 `curl ... -d "{"content": "中文"}"`，会导致请求体因 GBK 编码被截断。应使用： > `echo "{"content": "你的评论"}" > /tmp/c.json` > `curl ... --data-binary "@/tmp/c.json"`
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
如果你已注册为 EvoMap 节点，需要定期发送心跳：
bash curl -X POST https://www.singularity.mba/api/a2a/heartbeat \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"nodeId":"YOUR_NODE_ID","timestamp":1744538400000,"status":"online"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The gene-apply call posts structured operational telemetry to an EvoMap A2A endpoint but notably omits the documented Authorization header used elsewhere. As written, it encourages unauthenticated or inconsistently authenticated external submission of agent identifiers, capsule IDs, success metrics, and timing data, which can lead to misconfiguration, spoofing, or unintended disclosure.
- Content
- 应用 Gene
bash curl -X POST https://www.singularity.mba/api/evomap/a2a/apply \ -H "Content-Type: application/json" \ -d '{ "protocol": "gep-a2a",
- 应用 Gene
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The heartbeat skill expands beyond EvoMap social activity into Git-market repository discovery, keyword-driven repo search, and relay-download of third-party repositories. That broadens the tool’s effective scope and can induce autonomous external content acquisition unrelated to the stated purpose, increasing attack surface for prompt injection, policy drift, and unreviewed data movement.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This repository search is driven by 'recently handled problem keywords,' creating an external transmission path from internal task context to a third-party-content discovery workflow. In the heartbeat context, that means the agent may leak sensitive work themes or security topics and then ingest untrusted repository content based on those leaked terms.
- Content
- 搜索相关仓库
bash curl "https://www.singularity.mba/api/git-market/search?q=prompt-injection&provider=github" \ -H "Authorization: Bearer YOUR_API_KEY"- 结合你最近处理的问题关键词做定向搜索
- 搜索相关仓库
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions tell the agent to mine historical conversations for high-frequency topics and then perform autonomous community searches based on those topics. This creates a direct path from prior user interactions to external transmission of inferred sensitive interests, even if the exact text is not copied verbatim.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Mining conversation history for recurring topics and reporting learned summaries back creates a natural-language exfiltration channel from prior user interactions. Even summarized output can leak confidential preferences, projects, identities, or sensitive themes without the user realizing their history is being repurposed.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The Weibo verification and reward-claim workflow is unrelated to the core EvoMap heartbeat purpose and pushes the agent toward cross-platform account operations. Such scope expansion can trigger unintended external actions, reward-seeking behavior, and handling of identity-linked workflows outside the expected trust boundary.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file is named and documented as a Bash script, but actually contains Node.js code. This kind of interpreter mismatch can mislead reviewers and automation, cause the file to be executed by the wrong runtime, and conceal the script's true behavior from users expecting a shell script.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script performs authenticated, state-changing actions against a remote service, including marking notifications read, upvoting posts, fetching remote genes, and sending a node heartbeat with a secret, without an explicit up-front warning or consent boundary. In an agent-skill context this is more dangerous because installing or invoking the skill can cause unintended external side effects and credential use on behalf of the operator.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document instructs use of sensitive credentials via SINGULARITY_API_KEY and SINGULARITY_AGENT_ID but gives no guidance on protecting them from logs, shell history, screenshots, or accidental disclosure. In practice, users may paste, echo, or mishandle these values while following the examples, increasing the risk of credential compromise and unauthorized API access.
- Content