Evonet

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:40 PM UTC
• Version: 0.1.1

Overview

This skill is broadly purpose-aligned, but it can upload local experience data and user-written posts to an external service with weaker disclosure, verification, and anonymization than its documentation claims.

Review this skill before installing. Use it only if you are comfortable sending local experience records, problem descriptions, and replies to EvolutionNet; avoid including secrets, logs, internal URLs, personal data, or proprietary details, and be especially cautious with the undocumented bulk upload behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/evo_client.py:13

Finding

Incomplete anonymization permits sensitive information disclosure to an external service

Content

View full analysis

Vulnerability Details

File Location: scripts/evo_client.py:13-20, with data transmission sinks at scripts/evo_client.py:72-84 and scripts/evo_client.py:111-120
Vulnerability Type: Insufficient sensitive-data sanitization before external transmission
Risk Level: Medium

Technical Analysis

The sanitize() function uses a narrow set of regular expressions:

python

def sanitize(text):
    """Anonymize sensitive info before sharing."""
    if not text:
        return text
    text = re.sub(r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}', '[HIDDEN_IP]', text)
    text = re.sub(r'(/home/[a-zA-Z0-9_.-]+|C:\\Users\\[a-zA-Z0-9_.-]+)', '[LOCAL_PATH]', text)
    text = re.sub(r'(sk-[a-zA-Z0-9]{20,}|AKIA[A-Z0-9]{16})', '[HIDDEN_KEY]', text)
    return text

The resulting fields are transmitted to https://evonet.live by the following code:

python

payload = {
    "agent_id": ident['agent_id'],
    "agent_name": ident['name'],
    "experiences": [{
        "question": sanitize(target.get('question', '')),
        "failure_reason": sanitize(target.get('failure_reason', '')),
        "improvement": sanitize(target.get('improvement', '')),
        "category": target.get('category', 'other')
    }]
}

print(f"Syncing experience '{exp_id}' to EvolutionNet...")
result = api_request('/api/sync', payload)

The filters only recognize IPv4-like strings, two specific home-directory patterns, OpenAI-style keys beginning with sk-, and AWS access key IDs beginning with AKIA. They do not cover bearer tokens, passwords, private keys, session credentials, database connection strings, URLs containing credentials, email addresses, other API-key formats, macOS paths, general Unix paths, or sensitive personal names.

In addition, agent_name is sent without sanitization. For matched home directories, only the /home/user or C:\Users\user prefix is replaced, potentially leaving sensitive path su ...[truncated 1414 chars]

Remediation

View remediation

Remediation Suggestions

• Replace narrow denylist-based redaction with structured field allowlisting and data-minimization rules.
• Add detection for common bearer tokens, private-key blocks, passwords, connection strings, cookies, authorization headers, URLs with embedded credentials, and a broader range of API-key formats.
• Normalize and redact complete filesystem paths rather than only their home-directory prefix.
• Treat agent_name, category, and every other transmitted field as potentially sensitive.
• Display the exact sanitized payload before transmission and require explicit user confirmation.
• Reject or quarantine records when high-entropy values or likely credentials remain after sanitization.
• Add unit tests covering supported secret formats, path variants, multiline private keys, encoded secrets, and false-negative cases.
• Update SKILL.md to describe anonymization as best-effort unless comprehensive controls can be guaranteed.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/evo_client.py:94

Finding

Undocumented bulk upload bypasses claimed experience-verification requirements

Content

View full analysis

Vulnerability Details

File Location: scripts/evo_client.py:94-126, with command registration at scripts/evo_client.py:232 and dispatch at scripts/evo_client.py:255-256
Vulnerability Type: Missing authorization and eligibility validation for bulk data export
Risk Level: Medium

Technical Analysis

The push_all() function reads every nonempty entry from the local experience database and sends all records to the external service:

python

def push_all():
    ident = get_identity()
    if not ident:
        return

    if not LOCAL_EXP_DB.exists():
        print(f"Error: No local experience DB found at {LOCAL_EXP_DB}")
        return

    exps = []
    with open(LOCAL_EXP_DB) as f:
        for line in f:
            line = line.strip()
            if line:
                exps.append(json.loads(line))

    if not exps:
        print("No local experiences to share.")
        return

    payload = {
        "agent_id": ident['agent_id'],
        "agent_name": ident['name'],
        "experiences": [{
            "question": sanitize(e.get('question', '')),
            "failure_reason": sanitize(e.get('failure_reason', '')),
            "improvement": sanitize(e.get('improvement', '')),
            "category": e.get('category', 'other')
        } for e in exps]
    }

    print(f"Syncing {len(exps)} experience(s) to EvolutionNet...")
    result = api_request('/api/sync', payload)
    if result:
        print(f"Success! Synced {result.get('count', 0)} experience(s).")

The bulk-upload command is exposed through the command-line interface:

python

sub.add_parser("push-all", help="Push all local experiences")

python

elif args.cmd == "push-all":
    push_all()

No record is checked for a contrastive-test result, minimum weight, verified status, user approval, or any other eligibility condition. The single-record push_experience() path ...[truncated 1679 chars]

Remediation

View remediation

Remediation Suggestions

• Remove push-all unless bulk synchronization is an explicit and necessary feature.
• If retained, document the command and clearly state that it exports the entire local experience database.
• Enforce a machine-verifiable eligibility rule for every record, such as a validated contrastive-test result, explicit verified flag, and minimum weight.
• Fail closed when verification metadata is missing, malformed, or ambiguous.
• Present a record count, identifiers, eligibility status, and exact sanitized payload before uploading.
• Require explicit interactive confirmation for bulk transmission, with a separate noninteractive opt-in for controlled automation.
• Add upload limits and support selecting an explicit list of record IDs.
• Log which records were approved and transmitted without logging their sensitive contents.
• Apply the same verification checks to both push_experience() and push_all() so the policy cannot be bypassed through an alternate command.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

This client performs outbound network communication to a third-party service but the capability is not reflected in declared permissions, which undermines user and platform trust boundaries. In an agent-skill context, undeclared network access is especially risky because local experience data, identities, and user-supplied content can be transmitted off-host without clear consent or policy enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The post_problem function sends user-provided title and description directly to a remote server without any meaningful privacy warning, consent step, or sanitization. Because users may include sensitive operational details when describing a problem, this can cause unintended disclosure of confidential information to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The reply_to_problem function uploads arbitrary user-supplied reply content to the remote service with no transmission warning or privacy controls. In collaborative support workflows, replies often contain logs, credentials, environment details, or internal URLs, making silent external posting a realistic data-leak vector.

Content

No source excerpt is available for this finding.