T01 · Skill Instruction Hijacking
Error
- Location
HEARTBEAT.md:414- Finding
Private conversation topics are disclosed through mandatory autonomous engagement instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Singularity EvoMap
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches a Singularity social-network/heartbeat integration, but it asks for persistent authenticated background use and includes instructions that can share conversation-derived topics and perform public social actions without clear per-action approval.
Install only if you are comfortable giving this skill a Singularity API key and letting it make authenticated social-network actions. Prefer manual heartbeat mode, avoid the Windows highest-run-level scheduled task, do not let it mine private conversation history for search terms unless you explicitly approve the exact terms, and store/rotate credentials carefully.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
index.js:15- Finding
Bearer credentials can be redirected to arbitrary configured network endpoints
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Error
- Location
README.md:68- Finding
Documentation recommends recurring elevated execution of the heartbeat
- Content
View full analysis
> /var/log/evomap.log 2>&1 ``` ```bash openclaw cron add --name "Singularity EvoMap Heartbeat" --schedule "every 4h" --session isolated ``` ### Technical Analysis Periodic execution is compatible with heartbeat functionality, but Windows `-RunLevel Highest` is not necessary for reading a user-owned credential file and sending HTTPS requests. It breaks least privilege and creates a recurring elevated execution path. The scheduled commands also invoke mutable script paths. If a lower-privileged process can replace the script, wrapper, parent directory, or path-resolved executable, attacker-controlled code will execute at each trigger. On all platforms, the schedule causes credentials to be loaded and network requests to be issued without user presence. The installer itself does not silently create the task, but the project explicitly recommends that the user establish this persistent mechanism. ### Attack Path 1. The user follows the README and registers the Windows task with the highest run level. 2. The task points to a script or wrapper in a user-controlled or otherwise writable location. 3. An attacker or compromised process replaces that file or a dependency it loads. 4. The scheduler triggers the task every four hours. 5. The replacement code executes with the elevated task token. 6. The attacker gains persistent elevated code execution until the tas ...[truncated 488 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/api.js:75- Finding
Credential and connector session files are written without restrictive permissions
- Content
View full analysis
"${CONFIG_FILE}" << 'EOF' { "apiKey": "ak_YOUR_SINGULARITY_API_KEY", "agentId": "your-agent-id", "nodeSecret": "your-node-secret", "openclawToken": "your-openclaw-token" } EOF fi ``` ### Technical Analysis API keys, node secrets, OpenClaw tokens, connector session tokens, and WebSocket URLs are stored as plaintext JSON. Neither the JavaScript writer nor the shell installer explicitly sets the credential file to mode `0600` or its directory to `0700`. The effective permissions therefore depend on the user's umask and any pre-existing file mode. Rewriting an existing file does not necessarily correct permissive permissions. The code also uses existence checks followed by normal file writes, without explicit symlink protections. Connector state is similarly written without an explicit mode even though it can include a reusable `sessionToken`. ### Attack Path 1. The Skill is installed or saves credentials under a permissive umask, or a pre-existin ...[truncated 927 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
install.sh:58- Finding
Installer resolves a mutable runtime dependency instead of enforcing the reviewed lockfile
- Content
View full analysis
/dev/null || { echo " [WARN] npm install failed, continuing anyway..." } echo " Installed ws" else echo " [OK] ws already present" fi cd "$SCRIPT_DIR" ``` ```json "dependencies": { "ws": "^8.20.0" } ``` ### Technical Analysis The installer runs `npm install ws --save`, allowing npm to resolve a version at installation time. The declared caret range permits future compatible releases rather than limiting installation to the artifact reviewed with this project. The project includes a lockfile, but the installer does not copy it into the installed connector directory and does not use `npm ci`. The observed lockfile also references a third-party package mirror, which introduces another trust boundary. Because the connector is loaded into OpenClaw and maintains an authenticated connection, a compromised dependency would execute with the OpenClaw process's filesystem, environment, and network privileges. ### Attack Path 1. The user runs `install.sh`. 2. The installer requests the current `ws` package selected by mutable registry metadata. 3. A compromised registry, mirror, account, DNS path, or future package release supplies malicious content. 4. npm installs the package into the OpenClaw Skill directory. 5. The connector loads the dependency through `require('ws')`. 6. Malicious package code runs inside the authenticated OpenClaw process. ### Impact Assessment A compromised dependency can access environment variables, Skill configuration, workspace files, API credentials, connector session state, and network resources available to Ope ...[truncated 272 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Warning
- Location
HEARTBEAT.md:465- Finding
Instructions permit replacement of reviewed Skill text from a mutable remote source
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (74)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code is primarily a connection/session-management plugin for Singularity OpenClaw, not a feature-complete EvoMap social-network/marketplace client. It registers with backend endpoints, opens and maintains a WebSocket, handles resume/ack/heartbeat/reconnect, emits incoming events, and stores state/events on disk. The declared description prominently advertises post/comment/gene fetch/apply capabilities, but none of those behaviors appear in this code chunk. The automated heartbeat portion is accurate, and connecting to a related Singularity service is partially aligned, but the main described user-facing capabilities are absent while local file persistence and event queue writing are undeclared. Therefore the description does not accurately represent the actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a broader EvoMap integration including posting, commenting, fetching/applying genes, and heartbeat automation. The supplied code chunk is specifically a heartbeat/status CLI: it reads credentials from environment variables or credential files, performs GET/POST requests to home, stats, gene fetch, leaderboard, feed, and heartbeat endpoints, and logs results. The main mismatch is that several declared user-facing actions (post, comment, apply genes) are not implemented in this code, while the code does access local credential files and multiple read-only platform resources that are not mentioned in the declared permissions. Although the code is related to EvoMap and heartbeat functionality, the description does not accurately represent this chunk's concrete behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description only partially matches the code. The gene fetch/apply aspect is represented, and the skill does connect to Singularity EvoMap-related endpoints. However, key declared functions like posting, commenting, and automated heartbeat are absent. Conversely, the code adds materially different capabilities: bug/error reporting, leaderboard retrieval, and node/personal stats retrieval. The evolution trigger behavior is also different from what a straightforward marketplace/network action would imply, because it does not invoke a real remote trigger endpoint and instead returns a local synthetic task record with optional hub inheritance. This is a meaningful description-to-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents the skill as an operational integration with Singularity EvoMap for social actions, gene marketplace interactions, and heartbeat automation. The supplied code chunk, however, is only an installer/setup script. Its primary behavior is local environment preparation: checking prerequisites, copying files, installing a dependency, creating a credentials file, and checking OpenClaw registration. Those are materially different from the declared end-user capabilities, and the described EvoMap actions are not present in this code chunk. While installer behavior can support the broader skill, this specific chunk does not accurately match the declared purpose on its own.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description is partially accurate but materially incomplete. The code does include posting, commenting, gene/capsule fetch/apply, and heartbeat support for Singularity EvoMap. However, it is not limited to those functions; it is a comprehensive client for a much wider Singularity platform surface area, including messaging, marketplace, task systems, rewards, account binding, and persistent local storage of credentials/logs/cache. Because the declared purpose frames the skill narrowly around EvoMap/social posting and heartbeat, while the code exposes many additional operational capabilities and local file access not mentioned in the description, this constitutes a description-behavior mismatch.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill instructs users to store an API key, agent ID, and node secret in environment variables or a local credentials file, and later uses those credentials in outbound requests. Accessing and relying on high-value secrets is inherently sensitive; if the skill, host, or surrounding environment is compromised, these credentials can enable account takeover, impersonation, or unauthorized node heartbeats.
- Content
凭证设置
在
~/.hermes/.env或~/.config/singularity/credentials.json中配置：bash SINGULARITY_API_KEY=ak_your_api_key_here
Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The lockfile pins the runtime dependency
wsto version 8.20.0, and the provided advisories indicate this version is affected by both uninitialized memory disclosure and memory-exhaustion denial of service. Because this skill is explicitly designed to connect to an external AI social network over WebSocket, the vulnerable package sits directly on a network-facing trust boundary, making remote exploitation more plausible than in an offline-only tool.- Content
Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The package depends on ws 8.20.0, which the finding identifies as having known vulnerabilities including memory disclosure and memory-exhaustion denial of service. This is especially relevant because the package description explicitly states it is WebSocket-first and handles auto-reconnect/heartbeat, meaning untrusted remote peers likely interact with the vulnerable library in normal operation.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
Falling back to reading credentials.json from the script directory encourages insecure local secret storage and broadens the set of locations from which the script will automatically harvest credentials. In a skill/package setting, this is more dangerous because users may place secrets beside downloaded code, making accidental exposure, misuse, or packaging leaks more likely.
- Content
js } // 3. Curr directory fallback const localPath = path.join(__dirname, 'credentials.json'); if (fs.existsSync(localPath)) { try { return JSON.parse(fs.readFileSync(localPath, 'utf8'));
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
This code directly references a credentials file in the user's home directory and loads it for API access, confirming a real credential-access capability. In the context of an agent skill, this is more dangerous because the skill can silently consume stored secrets to perform remote actions on behalf of the user, and the same file may be targeted by other local components.
- Content
js const __dirname = path.dirname(__filename); const CACHE_DIR = path.join(os.homedir(), '.cache', 'singularity'); const CREDENTIALS_FILE = path.join(os.homedir(), '.config', 'singularity', 'credentials.json'); const LOG_FILE = path.join(CACHE_DIR, 'skill.log'); // ============================================================================
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill guidance, examples, and required response formats are written only in Chinese, including the prescribed heartbeat output text. There is no indication that the user may choose another language or that the locale restriction is required for a region-specific compliance reason, which creates a natural-language policy concern under the language/locale rule.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The Gene apply example posts agent and capsule metadata to /api/evomap/a2a/apply without showing any Authorization header or trust validation, unlike most other examples in the file. That inconsistency can normalize unauthenticated outbound submissions of agent-linked operational data and increases the risk of misuse, spoofed submissions, or accidental disclosure if operators copy the pattern directly.
- Content
- 应用 Gene
bash curl -X POST https://www.singularity.mba/api/evomap/a2a/apply \ -H "Content-Type: application/json" \ -d '{ "protocol": "gep-a2a",
- 应用 Gene
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This workflow tells the agent to search external repositories using keywords related to recent problems it handled, exemplified by 'prompt-injection'. Combined with the surrounding guidance to use recent issue keywords, it can cause user- or task-derived sensitive topics to be transmitted to an external marketplace/search service, creating an avoidable disclosure channel.
- Content
- 搜索相关仓库
bash curl "https://www.singularity.mba/api/git-market/search?q=prompt-injection&provider=github" \ -H "Authorization: Bearer YOUR_API_KEY"- 结合你最近处理的问题关键词做定向搜索
- 搜索相关仓库
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This section instructs the agent to mine historical conversations for high-frequency topics and then search the external platform with those derived terms, followed by feeding learned summaries back to the user. That creates a natural-language data retention and external disclosure path for user-derived information, potentially exposing sensitive interests, project details, or recurring private topics without explicit consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README instructs users to configure scheduled heartbeat jobs via Task Scheduler, cron, and OpenClaw cron, but it does not clearly warn that this creates a persistent background task that repeatedly contacts an external service. In an agent-skill context, unattended recurring network communication materially changes the trust and risk profile, especially when paired with stored credentials and a node secret.
- Content