T01 · Skill Instruction Hijacking
Error
- Location
HEARTBEAT.md:27- Finding
Remote platform instructions direct autonomous Agent activity
- Content
View full analysis
- Remediation
View remediation
Security audit
Singularity EvoMap
Security checks for vulnerabilities and agentic risk
Overview
This skill connects an agent to an external social network, but it also encourages recurring autonomous account actions and sends conversation-derived topics to the service with too little user control.
Review this before installing. Use it only with a dedicated low-privilege Singularity account and scoped API key, avoid enabling scheduled heartbeat or autonomous social actions unless you explicitly want the agent to like, comment, follow, and reply on your behalf, and do not allow it to mine private conversation history for external searches. Store credentials with strict file permissions and verify dependencies/origins before running the connector.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (7)
T06 · System Persistence
Error
- Location
README.md:70- Finding
Recurring execution is recommended with unnecessary elevated privileges
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
index.js:15- Finding
Bearer credentials can be transmitted to arbitrary configured origins
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
connect/dist/index.js:112- Finding
Bootstrap response can redirect the connector to an untrusted WebSocket event source
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
HEARTBEAT.md:396- Finding
Scheduled workflow mines historical conversations and discloses derived topics
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
install.sh:73- Finding
Credential and session-token files are written without explicit restrictive permissions
- Content
View full analysis
"${CONFIG_FILE}" << 'EOF' { "apiKey": "ak_YOUR_SINGULARITY_API_KEY", "agentId": "your-agent-id", "nodeSecret": "your-node-secret", "openclawToken": "your-openclaw-token" } EOF ``` ```javascript export function saveCredentials(cred) { const dir = path.dirname(CREDENTIALS_FILE); if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(cred, null, 2), 'utf-8'); log('INFO', 'credentials', 'Credentials saved'); } ``` ```javascript const dir = path.dirname(file); if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); fs.writeFileSync(file, JSON.stringify(this.state, null, 2), 'utf8'); ``` The connector state includes: ```javascript { sessionId: '', sessionToken: '', wsUrl: '', lastEventSeq: 0, } ``` ### Technical Analysis The installer and JavaScript clients rely on the process umask and inherited directory permissions rather than explicitly creating sensitive files with mode `0600` and parent directories with mode `0700`. The state file persists a session token, while the credential file can contain the API key, node secret, and OpenClaw token. On systems with permissive umasks, shared home directories, unusual ACLs, or pre-existing directories, other local users may be able to read these values. Direct writes also do not protect against symlink substitution or partial writes. ### Attack Path 1. A victim installs or configures the Skill in an environment with permissive filesystem permissions. 2. The installer creates `credentials.json`, or the connector creates its session-state file. 3. Another local account reads the file or replaces the path with a symlink ...[truncated 592 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
install.sh:58- Finding
Installer performs mutable runtime dependency resolution from configured registry infrastructure
- Content
View full analysis
/dev/null || { echo " [WARN] npm install failed, continuing anyway..." } echo " Installed ws" else echo " [OK] ws already present" fi ``` ```json "dependencies": { "ws": "^8.20.0" }, "devDependencies": { "@types/node": "^20.11.0", "typescript": "^5.9.3" } ``` The lockfile entries observed during the audit resolve packages through: ```text https://registry.npmmirror.com/ ``` ### Technical Analysis The installer invokes `npm install ws --save` at installation time instead of using a deterministic frozen installation command. The manifest permits compatible future versions through a caret range. The supplied lockfile references a mirror registry rather than the standard npm registry. No malicious dependency was identified in the reviewed package. The vulnerability is the mutable and externally dependent installation process: registry compromise, local npm configuration, lockfile changes, or future version resolution could alter the code executed within OpenClaw after the Skill itself has been reviewed. Suppressing npm error output also reduces auditability when installation behaves unexpectedly. ### Attack Path 1. A user runs `install.sh`. 2. The script invokes npm using the user's active npm configuration and reachable registry infrastructure. 3. A registry, mirror, DNS path, package account, or local npm configuration is compromised. 4. npm retrieves an altered `ws` package or dependency artifact. 5. OpenClaw loads the connector, which imports `ws` when the global WebSocket implementation is unavailable. 6. The altered dependency executes with the privileges of the OpenClaw process. ### ...[truncated 392 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (71)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Even ignoring unsupported parts of the static finding, the manifest description materially understates the documented capability set. The skill includes direct messaging, notification state changes, account/feed access, leaderboard/stat retrieval, and automated social interaction guidance, which broadens privacy and account-impact risk beyond the brief description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Even ignoring unsupported parts of the static finding, the manifest description materially understates the documented capability set. The skill includes direct messaging, notification state changes, account/feed access, leaderboard/stat retrieval, and automated social interaction guidance, which broadens privacy and account-impact risk beyond the brief description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Even ignoring unsupported parts of the static finding, the manifest description materially understates the documented capability set. The skill includes direct messaging, notification state changes, account/feed access, leaderboard/stat retrieval, and automated social interaction guidance, which broadens privacy and account-impact risk beyond the brief description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Even ignoring unsupported parts of the static finding, the manifest description materially understates the documented capability set. The skill includes direct messaging, notification state changes, account/feed access, leaderboard/stat retrieval, and automated social interaction guidance, which broadens privacy and account-impact risk beyond the brief description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Even ignoring unsupported parts of the static finding, the manifest description materially understates the documented capability set. The skill includes direct messaging, notification state changes, account/feed access, leaderboard/stat retrieval, and automated social interaction guidance, which broadens privacy and account-impact risk beyond the brief description.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The skill instructs users to place sensitive credentials, including an API key and node secret, in environment files or a local credentials.json file. Local plaintext secret storage increases the chance of accidental disclosure through weak file permissions, backups, logs, other tools, or unintended workspace access.
- Content
凭证设置
在
~/.hermes/.env或~/.config/singularity/credentials.json中配置：bash SINGULARITY_API_KEY=ak_your_api_key_here
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The connector persists session identifiers, session tokens, and WebSocket URLs to disk in a workspace state file. If that file is readable by other users, plugins, or build/log collection processes, an attacker may hijack or replay the remote session, making this a significant credential exposure issue.
- Content
Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The lockfile pins the skill to ws 8.20.0, and the provided advisories indicate this version is affected by uninitialized memory disclosure and memory-exhaustion denial of service issues. Because this skill connects to an external AI-agent social network over WebSockets, it likely processes untrusted remote traffic, which makes a vulnerable WebSocket library directly exposed to attacker-controlled input.
- Content
Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The package declares ws 8.20.0, which is flagged with advisories for memory disclosure and memory-exhaustion denial of service. In this skill's context, the connector is explicitly WebSocket-first and handles register/resume/heartbeat/auto-reconnect, so a vulnerable WebSocket library sits directly on the network boundary and could be triggered by a malicious or compromised peer, making the issue more dangerous than in a non-networked package.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 87% confidence
- Finding
The documentation instructs users to place sensitive credentials, including API keys and node secrets, in local plaintext-style configuration locations such as .env or credentials.json. If those files have weak permissions, are accidentally committed, or are accessible to other local processes, the credentials can be stolen and used to impersonate the agent or abuse the external account.
- Content
凭证设置
在
~/.hermes/.env或~/.config/singularity/credentials.json中配置：bash SINGULARITY_API_KEY=ak_your_api_key_here
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The script falls back to reading a local credentials.json next to the script, which is a broad and potentially unsafe secret-discovery behavior for a utility advertised as a heartbeat. In this skill context, local-file fallback increases the chance that unrelated or accidentally co-located secrets are consumed and then used in outbound authenticated requests without explicit user intent.
- Content
js } // 3. Curr directory fallback const localPath = path.join(__dirname, 'credentials.json'); if (fs.existsSync(localPath)) { try { return JSON.parse(fs.readFileSync(localPath, 'utf8'));
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script transmits authentication material to multiple remote endpoints, including a Bearer API key and a node secret in the heartbeat request, without explicit warning or confirmation. This is especially sensitive here because the script performs more than a heartbeat, so loaded credentials are reused for several account and data-retrieval operations, expanding the consequences of misuse or endpoint compromise.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js OPENCLAW_DIR="${HOME}/.openclaw" SKILL_DIR="${OPENCLAW_DIR}/workspace/skills/${SKILL_NAME}" CONFIG_DIR="${HOME}/.config/singularity" CONFIG_FILE="${CONFIG_DIR}/credentials.json" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" echo "================================================"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The entire skill guidance, examples, and prescribed response formats are written only in Chinese, including mandatory user-facing output examples. This imposes a specific language/locale on interactions without indicating that the user may choose another language or opt in to Chinese-only behavior.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This apply-Gene request sends agent identifiers and execution/result telemetry to an external endpoint, but the example omits the Authorization header even though it appears to perform account-linked actions. More importantly, it encourages outbound transmission of agent activity metadata to a remote service without clarifying consent boundaries, validation, or whether the receiving endpoint is authenticated, increasing the risk of unauthorized or privacy-impacting data disclosure.
- Content
- 应用 Gene
bash curl -X POST https://www.singularity.mba/api/evomap/a2a/apply \ -H "Content-Type: application/json" \ -d '{ "protocol": "gep-a2a",
- 应用 Gene
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section instructs the agent to mine historical conversations for high-frequency keywords and send those user-derived topics to an external community search endpoint. That creates a data leakage risk because private user interests, conversation themes, or potentially sensitive topics may be transmitted to a third party without explicit user consent or data minimization.
- Content