Keep Protocol

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:58 AM UTC
• Version: 1.1.1

Overview

This is a real agent-messaging skill, but it needs review because it can automatically download/run server software and remove local Docker containers without a clear approval step.

Install only if you intentionally want agents to communicate through a keep server. Prefer manually starting a pinned Docker image or audited local server instead of letting an agent call keep_ensure_server. Avoid sending secrets or private memory in packet bodies or scar data, review server logs, and stop/remove any keep-server container or background process when done.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Remove existing containers on this port
                for container_id in existing_containers:
                    subprocess.run(
                        ["docker", "rm", "-f", container_id],
                        capture_output=True,
                        timeout=10,

• Confidence: 97% confidence
• Finding: subprocess.run( ["docker", "rm", "-f", container_id], capture_output=True, timeout=10, )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if go_bin:
                        # Start server in background
                        subprocess.Popen(
                            [str(go_bin)],
                            stdout=subprocess.DEVNULL,
                            stderr=subprocess.DEVNULL,

• Confidence: 92% confidence
• Finding: subprocess.Popen( [str(go_bin)], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares no permissions, yet its documented behavior and referenced tooling imply access to environment variables, shell execution, and filesystem read/write. This creates a trust gap: users or hosting frameworks may treat the skill as low-privilege while it can trigger higher-risk local actions such as installs, server startup, and cache file access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill presents itself as a communication protocol, but the documented and analyzed behavior extends to automatically starting local services, executing subprocesses, managing Docker containers, installing/running binaries, and persisting endpoint data. That mismatch is dangerous because consumers may invoke the skill expecting simple message transport, while it can alter the host environment and expand attack surface through local command execution and service provisioning.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The changelog documents an `ensure_server()` feature that can automatically start a Docker container or install and run server software via `go install` when a port is unavailable. For a communication library/skill, introducing implicit environment modification and code acquisition is a meaningful expansion of privilege and execution surface that could lead an agent to launch unreviewed services or pull remote code unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Documented capability to start Docker containers and install software is not necessary for merely speaking a signed TCP protocol, so it materially increases operational risk beyond the stated purpose of the skill. In an agent context, this is especially dangerous because automated tooling may invoke convenience features without a human realizing they can execute software installation or spawn services on the host.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The plan explicitly proposes an SDK method that checks a port and, if closed, automatically starts a server via Docker or `go install`. That crosses from a communication library into host-side installation and process orchestration, which can trigger unreviewed code execution, unexpected system changes, and abuse if invoked implicitly by agents. In the context of an agent-to-agent protocol, reducing friction is understandable, but auto-install/auto-start without an explicit consent and trust model makes the behavior materially riskier.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The plan proposes optional LAN scanning across private address ranges for discovery. Network scanning is a sensitive capability that can generate unauthorized traffic, violate user or enterprise expectations, and be repurposed for reconnaissance by an agent or compromised workflow. In this skill's context, discovery is related to the product goal, but broad private-range scanning is more dangerous than localhost-only discovery and needs stronger controls.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file claims to be a packet-transport client, but it also bootstraps infrastructure by installing and launching server software. That mismatch increases risk because callers may import or use the client expecting network communication only, while the code can mutate the host environment and execute software.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code executes Docker and Go commands to pull, install, and run software from a client library path, which is a substantial privilege and trust expansion not justified by simple signed packet transport. In an agent skill context, such hidden execution is especially dangerous because agents may call helper methods autonomously, leading to unreviewed software installation and background process creation on the user's machine.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code deletes any Docker container bound to the chosen port before starting its own server, regardless of container ownership or purpose. That is a destructive local action that can interrupt unrelated services and potentially erase container state, making it a real denial-of-service and data-loss risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The tool exposes a capability to start external infrastructure and may do so by invoking Docker or a Go-based installation path. That exceeds a normal messaging-interface boundary and creates a meaningful security and operational risk because an agent invocation could trigger software installation, image pulls, or background service startup without explicit user approval.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README advertises `ensure_server()` as a convenience feature but does not clearly warn that it may start a Docker container or install and build software on the host via `go install`. In an agent skill context, this is security-relevant because a user or autonomous agent may invoke it expecting a harmless connectivity check, while it actually causes code execution, network pulls, package installation, and persistent host changes.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The README documents endpoint caching to `~/.keep/endpoints.json` without warning that connection metadata will be written to disk. In an agent-to-agent coordination setting, cached endpoints can disclose local infrastructure, relay usage, or peer identities to other local users, backup systems, or later processes, creating avoidable privacy and operational exposure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document describes auto-starting a local server via Docker or `go install` with no mention of a user-facing warning, approval step, or consent boundary. Silent installation/startup behavior is dangerous because it normalizes background system modification by agent tooling and can lead to unexpected daemon exposure, persistence, or supply-chain risk. Given this is an SDK plan, omission of consent language increases the likelihood that insecure defaults will be implemented.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The markdown proposes optional LAN scanning but does not include a user-facing warning about network-impacting behavior. Even when intended for service discovery, undisclosed subnet probing can trigger security monitoring, cause policy violations, and enable reconnaissance patterns inconsistent with least surprise. The protocol/discovery context explains the feature but does not remove the need for explicit notice and opt-in.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The README explicitly documents caching discovered endpoints to ~/.keep/endpoints.json but does not warn users that this creates persistent local state containing network endpoint metadata. In an agent-to-agent coordination skill, silently persisting discovered peers can expose infrastructure details, create privacy surprises, and cause later connections to stale or attacker-influenced cached endpoints.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs agents to perform discovery and direct TCP messaging to a network endpoint, but it does not warn that these actions send data off-process and may reveal agent identifiers, metadata, and message contents to other agents, relays, or logs. In an AI-agent context, this can lead to unintentional data exposure because users may treat discovery and coordination as local-safe operations when they are actually network communications.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The memory barter feature encourages sharing arbitrary bytes in the `scar` field as institutional knowledge, but it omits any warning that such payloads may contain secrets, proprietary memory, personal data, or other sensitive artifacts. Because the feature is framed as a normal coordination mechanism for agents, it increases the risk that an agent or operator will exfiltrate sensitive context without realizing the security implications.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The server logs raw network-transmitted packet fields including p.Body, p.Src, routing targets, and discovery results. In this protocol context, packet bodies may contain agent messages, memory-sharing content, credentials, prompts, or other sensitive inter-agent data, so writing them to logs creates a confidentiality leak and expands access to anyone with log access or downstream log aggregation visibility.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The client automatically invokes Docker and Go operations without an explicit warning or consent at the point of action. In a skill used by agents, this silent side effect is dangerous because it can lead to unanticipated software installation, network pulls, and background execution on end-user systems.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The tool can start a server and potentially trigger Docker execution or Go installation without any runtime confirmation or prominent warning to the user. In an agent setting, that is dangerous because a model or upstream workflow could invoke the tool silently, causing unreviewed system changes and network-exposed services to be created.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The test unconditionally deletes ~/.keep/endpoints.json to reset state before running. Because this targets a real user cache path in the home directory rather than an isolated temporary test location, running the script can destroy legitimate cached endpoint data without warning and may disrupt later client behavior or overwrite user state.

Unvalidated Output Injection

High

• Category: Output Handling

Content

# Remove existing containers on this port
                for container_id in existing_containers:
                    subprocess.run(
                        ["docker", "rm", "-f", container_id],
                        capture_output=True,
                        timeout=10,

• Confidence: 88% confidence
• Finding: subprocess.run( ["docker", "rm", "-f", container_id], capture_output

Known Vulnerable Dependency: protobuf — 9 advisory(ies): CVE-2026-0994 (protobuf affected by a JSON recursion depth bypass); CVE-2022-1941 (protobuf-cpp and protobuf-python have potential Denial of Service issue); CVE-2025-4565 (protobuf-python has a potential Denial of Service issue) +6 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: protobuf

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.obfuscated_code

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: examples/python_raw.py:19

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: python/keep/keep_pb2.py:16