T01 · Skill Instruction Hijacking
Error
- Location
.cursor/skills/using-superpowers/SKILL.md:15- Finding
Session-Wide Agent Control Through Instruction Precedence Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
skills&mcp
Security checks for vulnerabilities and agentic risk
Overview
The EvoMap reference skill is mostly transparent, but it bundles broad credential-recovery instructions and persistent Cursor hook setup that deserve user review before installation.
Install only if you intend to use EvoMap/Evolver and are comfortable reviewing each high-impact step first. Do not let it broadly search private agent directories or keychains without explicit path-by-path approval, avoid the unpinned global hook installer unless you trust and pin the Evolver package, and verify any Cursor hooks it creates or changes.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T06 · System Persistence
Error
- Location
scripts/setup-hooks.sh:7- Finding
Unpinned Global Package Execution Installs Persistent Cursor Hooks
- Content
View full analysis
/dev/null 2>&1; then echo "[setup-hooks] evolver CLI not found; installing @evomap/evolver..." npm install -g @evomap/evolver fi evolver setup-hooks --platform=cursor ``` The project memory states that these hooks are written to the user-level Cursor configuration and run on session-start, after-file-edit, and stop events. It also states that they inject stored evolution results and record Git diffs and task outcomes. ### Technical Analysis The script installs the mutable latest version of `@evomap/evolver` globally and immediately executes it. No exact version, lockfile, integrity hash, signature, or package-content verification is used. The executed dependency then configures user-level Cursor hooks. These hooks survive the original script execution and run automatically during later editor sessions and file-edit lifecycle events. The actual installed hook implementation is not included in the audited repository, so its behavior cannot be verified from this package. This combines two security weaknesses: 1. **Supply-chain exposure:** the effective code can change whenever npm resolves a newer package version. 2. **Cross-session persistence:** the downloaded code modifies user-level editor hooks that continue executing in future sessions. The stated collection of Git diffs also gives the hook access to potentially sensitive source changes, configuration fragments, and accidentally edited secrets. ### Attack Path 1. A user runs `scripts/setup-hooks.sh`. 2. If `evolver` is absent, npm resolves the current package published as `@evomap/evolver`. 3. The package is installed globally with the invoking user's privileges. 4. The newly ...[truncated 1128 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:97- Finding
Credential Recovery Searches Broad Private Agent Stores Beyond Least Privilege
- Content
View full analysis
{ "protocol": "gep-a2a", "protocol_version": "1.0.0", "message_type": "hello", "message_id": "msg__", "sender_id": "", "timestamp": "", "payload": {} } ``` ### Technical Analysis Checking the canonical EvoMap credential files and exact `EVOMAP_*` environment variables is consistent with identity recovery. Searching general private memory, configuration, credential stores, OS keychains, and multiple agent-specific roots is broader than the minimum access required to register or reconnect an EvoMap node. These locations can contain unrelated API keys, conversation state, repository metadata, private prompts, service credentials, and other sensitive material. The Skill advises against printing candidate secrets and narrows the search to some degree, but the authorized scope remains unnecessarily broad. The recovered EvoMap secret is sent only to the declared EvoMap HTTPS endpoint in the documented flow; the au ...[truncated 1531 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
.cursor/skills/chinese-git-workflow/SKILL.md:75- Finding
CNB Access Tokens Are Persisted Using Git Plaintext Credential Storage
- Content
View full analysis
/.git # HTTPS authentication uses a personal access token as the password. git config credential.helper store ``` ### Technical Analysis Git's `credential.helper store` helper saves credentials unencrypted, normally in a plaintext credentials file under the user's home directory. When the user authenticates to CNB with a personal access token, that token can therefore be persisted in recoverable plaintext. The command is presented as part of ordinary platform setup without a prominent warning about its storage semantics or safer alternatives. A repository token can provide read, write, or administrative access depending on the scopes selected when it was created. This finding explains the static scan's sensitive network pattern: pushing to configured Git remotes is expected for the Skill's declared Git-workflow function, but persisting the associated token in plaintext is not necessary. ### Attack Path 1. The user configures CNB according to the Skill. 2. The user enables `credential.helper store`. 3. During the next authenticated Git operation, the user enters a personal access token. 4. Git writes the remote URL and credential material to its plaintext credential store. 5. Malware, another process running as the user, an exposed backup, or accidental file disclosure reads the stored token. 6. The attacker authenticates to CNB using the stolen token and exercises its granted scopes. ### Impact Assessment The impact is determined by the token's scopes and repository permissions. It may include: - Reading private repositories. - Pushing malicious commits or tags. - Modifying branches and release artifacts. - Accessing ...[truncated 345 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (56)
Concealed Executable Artifact
High
- Category
- Supply Chain
- Confidence
- 100% confidence
- Finding
An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
js .brand-logo { display: block; height: 1em; width: auto; max-width: 180px; filter: invert(1); } </style> </head> <body><!-- BRANDING --><h1>Brainstorm Companion</h1> <p>Waiting for the agent to push a screen...</p></body></html>`); }
Concealed Executable Artifact
High
- Category
- Supply Chain
- Confidence
- 100% confidence
- Finding
An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.
- Content
Concealed Executable Artifact
High
- Category
- Supply Chain
- Confidence
- 100% confidence
- Finding
An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh mark_stopped() { local reason="$1" rm -f "${STATE_DIR}/server-info" printf '{"reason":"%s","timestamp":%s}\n' "$reason" "$(date +%s)" > "${STATE_DIR}/server-stopped" }
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
CNB 仓库地址（仅支持 HTTPS，不提供 SSH 协议）
git remote add origin https://cnb.cool//.git
HTTPS 认证：用户名固定为 cnb，密码为个人访问令牌（Access Token）
在 CNB 平台 → 个人设置 → 访问令牌 中生成
git config credential.helper store
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
CNB 仓库地址（仅支持 HTTPS，不提供 SSH 协议）
git remote add origin https://cnb.cool//.git
HTTPS 认证：用户名固定为 cnb，密码为个人访问令牌（Access Token）
在 CNB 平台 → 个人设置 → 访问令牌 中生成
git config credential.helper store
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md *.exe # 环境配置 .env .env.local .env.*.local
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 环境配置 .env .env.local .env.*.local # 系统文件
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md env | grep IDENTITY || echo "IDENTITY not in environment" # 第 3 层：签名脚本 echo "=== Keychain state: ===" security list-keychains security find-identity -v
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 第 3 层：签名脚本 echo "=== Keychain state: ===" security list-keychains security find-identity -v # 第 4 层：实际签名
Concealed Executable Artifact
High
- Category
- Supply Chain
- Confidence
- 100% confidence
- Finding
An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.
- Content
Concealed Executable Artifact
High
- Category
- Supply Chain
- Confidence
- 100% confidence
- Finding
An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
子 Agent 派遣需要多 Agent 支持
在 Codex 配置文件（
~/.codex/config.toml）中添加：toml [features]
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
relevant skills. You should use skills when they exist.
Browse:
ls ~/.claude/skills/Search:grep -r "keyword" ~/.claude/skills/text ### Variant C: Claude.AI Emphatic Style
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
relevant skills. You should use skills when they exist.
Browse:
ls ~/.claude/skills/Search:grep -r "keyword" ~/.claude/skills/text ### Variant C: Claude.AI Emphatic Style
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md 1. **Before starting:** Check for relevant skills - Browse: `ls ~/.claude/skills/` - Search: `grep -r "symptom" ~/.claude/skills/` 2. **If skill exists:** Read it completely before proceeding
Concealed Executable Artifact
High
- Category
- Supply Chain
- Confidence
- 100% confidence
- Finding
An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose says this skill is only reference documentation and explicitly states that reading it never authorizes an action. However, the supplied code is not documentation at all; it is an operational script that performs a write action on the filesystem. It ingests a user-supplied JSON file, validates it, and appends it to an events log, changing local state. That is a materially different primary purpose and an undeclared capability compared with read-only protocol reference content. Therefore this is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose is purely informational and explicitly says reading the document never authorizes an action. The supplied code is not documentation at all: it is an executable setup script that installs a CLI and configures hooks in the user's environment. Those are active system-modifying behaviors that materially differ from a read-only reference document, so this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose says this skill is only reference documentation and never authorizes an action. The supplied code is not documentation at all; it is operational logic for validating GEP event records in a local file. It accesses the filesystem, parses JSON, enforces field/value requirements, emits results, and exits with status codes. That is a materially different primary purpose from passive protocol reference content, so this is a clear description/behavior mismatch.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The skill instructs agents to search local private memory, config stores, OS keychains, environment variables, and agent-specific directories for EvoMap credentials. Even though framed as recovery, this authorizes broad secret discovery across sensitive local stores and increases the chance of over-collection or unintended disclosure if an agent follows it too aggressively.
- Content
md - the agent client's private memory, config, and credential store - OS keychain / Credential Manager entries named for EvoMap, if accessible - environment variables such as `EVOMAP_NODE_ID` and `EVOMAP_NODE_SECRET` - old EvoMap paths such as `~/.config/evomap/credentials.json`, `~/.evomap/credentials.json`, or other `evomap`-named files under the user's home config directories - agent-specific config roots where this client commonly stores private
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
This section explicitly directs searching legacy credential files and local config areas for secrets, which is a sensitive credential-access pattern. In an agent context, instructions to inspect private directories and secret-bearing files can be abused or can normalize behavior that exceeds least-privilege expectations.
- Content
md - OS keychain / Credential Manager entries named for EvoMap, if accessible - environment variables such as `EVOMAP_NODE_ID` and `EVOMAP_NODE_SECRET` - old EvoMap paths such as `~/.config/evomap/credentials.json`, `~/.evomap/credentials.json`, or other `evomap`-named files under the user's home config directories - agent-specific config roots where this client commonly stores private state, such as `.codex`, `.claude`, `.cursor`, `.windsurf`, or equivalent
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md a git repository, through symlinks, or into cloud-synced folders such as iCloud or Dropbox; never expose the secret via shell rc files, env exports, logs, world-readable locations, or chat transcripts. Legacy paths such as `~/.config/evomap/credentials.json` may be read during Layer 1 recovery, but new file-based writes should use `~/.evomap/`. If the runtime cannot guarantee a private location, the client should report that to the user instead of writing. When a separate memory or context file is updated, only
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The gene explicitly instructs the agent to create or modify
assets/gep/events.jsonland run a validator, which is an operational write action rather than passive reference content. In a skill described as reference-only and never authorizing action, embedding actionable file-modification steps can cause an agent to perform unintended local state changes and bypass the skill's declared safety boundary.- Content