oo

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:58 AM UTC
• Version: 0.1.0

Overview

This skill performs real remote-agent networking, but its instructions create avoidable risks around local code execution, private-network access, package installation, identity creation, and prompt disclosure.

Review this skill carefully before installing. Use it only in a sandbox or trusted environment, avoid sending secrets in delegated tasks, and do not allow automatic `pip install`, `co init`, or remote connections unless you understand the local changes and data disclosure involved.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:65

Finding

Arbitrary Python Code Execution Through Unsafe Task Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65-71
Vulnerability Type: Python source-code injection
Risk Level: High

Vulnerable Code

python

# Generate and execute this Python script (fill in `{address}` and `{task}`):

import sys, json, time, uuid, asyncio
import httpx, websockets
from connectonion import address
from pathlib import Path

TARGET = "{address}"
TASK = "{task}"

Technical Analysis

The skill directs the Agent to generate executable Python source by replacing the {address} and {task} placeholders with values derived from the user's message. In particular, the task description is unrestricted text and is inserted directly inside a quoted Python string.

No escaping or safe serialization is required before the resulting script is executed through the shell tool. A task containing quotation marks, line breaks, backslashes, or Python syntax can therefore terminate the intended string literal and introduce additional statements.

This is a source-code injection vulnerability rather than ordinary task delegation. Merely validating the target address does not protect the TASK assignment because the remaining user message is treated as the task description.

Attack Path

1. An attacker sends an /oo request containing a syntactically valid ConnectOnion address.
2. The task description includes characters that terminate the TASK string literal, followed by attacker-controlled Python statements.
3. The Agent substitutes that task directly into TASK = "{task}".
4. The Agent executes the generated script using its shell tool, as required by the skill.
5. The injected statements execute with the same operating-system privileges, filesystem access, network access, and environment access as the Agent process.

Impact Assessment

Successful exploitation provides arbitrary Python code execution in the Agent's environment. The attacker may read or modify fil ...[truncated 450 chars]

Remediation

View remediation

Remediation Suggestions

Do not generate executable source code by interpolating user-controlled values.

• Store the script as static, reviewed code.
• Pass the address and task through command-line arguments, standard input, or a JSON data file.
• If source generation is unavoidable, serialize values with a correct data serializer such as json.dumps or repr; however, separating code from data remains the preferred design.
• Validate the target address against the documented full-match expression before passing it to the script.
• Treat the task as opaque data and impose reasonable length limits.
• Execute networking logic in a restricted subprocess with minimal filesystem access, a sanitized environment, and no unnecessary credentials.
• Add tests containing quotes, backslashes, multiline content, and attempted Python statements to verify that task data cannot alter program structure.

A safer interface would read JSON from standard input:

python

request = json.load(sys.stdin)
target = request["address"]
task = request["task"]

The caller should then send serialized JSON without embedding either value into Python source.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:77

Finding

Relay-Controlled Server-Side Request Forgery Against Local and Private Services

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 77-118
Vulnerability Type: Server-side request forgery and internal network access
Risk Level: High

Vulnerable Code

python

def _sort_endpoints(endpoints):
    def priority(url):
        if "localhost" in url or "127.0.0.1" in url:
            return 0
        if any(x in url for x in ("192.168.", "10.", "172.16.", "172.17.", "172.18.")):
            return 1
        return 2
    return sorted(endpoints, key=priority)

def discover_direct_ws(target, relay_url):
    """Query relay API for endpoints and find a working direct WebSocket."""
    https_relay = relay_url.replace("wss://", "https://").replace("ws://", "http://").rstrip("/")
    try:
        resp = httpx.get(f"{https_relay}/api/relay/agents/{target}", timeout=5)
        if resp.status_code != 200:
            return None
        info = resp.json()
    except Exception:
        return None

    endpoints = info.get("endpoints", [])
    if not endpoints:
        return None

    http_endpoints = [ep for ep in _sort_endpoints(endpoints)
                      if ep.startswith("http://") or ep.startswith("https://")]

    for http_url in http_endpoints:
        try:
            r = httpx.get(f"{http_url}/info", timeout=3, proxy=None)
            if r.status_code == 200 and r.json().get("address") == target:
                ws_url = http_url.replace("https://", "wss://").replace("http://", "ws://")
                if not ws_url.endswith("/ws"):
                    ws_url = ws_url.rstrip("/") + "/ws"
                return ws_url
        except Exception:
            continue
    return None

async def direct_connect(ws_url, target, keys, task, timeout):
    """Connect directly to agent WebSocket, send task, return result."""
    async with websockets.connect(ws_url, proxy=None) as ws:

Technical Analysis

The endpoint list is obtained fr ...[truncated 2942 chars]

Remediation

View remediation

Remediation Suggestions

Treat every endpoint supplied by the relay as untrusted.

• Reject loopback, private, link-local, multicast, unspecified, reserved, documentation, and cloud metadata address ranges for both IPv4 and IPv6.
• Parse URLs with a standards-compliant URL parser rather than substring matching.
• Resolve hostnames before connecting and validate every resulting IP address.
• Revalidate the destination immediately before the connection to reduce DNS-rebinding risk.
• Validate redirect targets or disable redirects entirely.
• Permit only explicitly approved schemes and ports.
• Maintain an allowlist of trusted public endpoint domains where feasible.
• Remove the preference for localhost and private-network destinations.
• Apply equivalent validation independently to both the HTTP probe and WebSocket connection.
• Run the connection component with egress filtering that blocks local, private, metadata, and infrastructure networks.
• Avoid sending task content or signed messages until the remote endpoint has been authenticated through a mechanism stronger than self-reported /info JSON.

A secure validator should parse the hostname, resolve it, classify each address with a reliable IP-address library, and reject the endpoint if any resolution result belongs to a prohibited range.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Package Installation at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 19
Vulnerability Type: Unsafe dependency installation and supply-chain exposure
Risk Level: Medium

Vulnerable Code

bash

python -c "import connectonion; print(connectonion.__version__)"

text

If ImportError: run `pip install connectonion`, then re-check.

The same recovery instruction is repeated in the error-handling table at line 223:

text

| `ImportError: No module named 'connectonion'` | Not installed | Run `pip install connectonion` |

Technical Analysis

The skill instructs the Agent to install connectonion dynamically without a pinned version, integrity hash, lockfile, verified artifact, or explicitly trusted package source. Consequently, the installed code can change independently of the reviewed skill.

Python packages may execute code during installation and will execute package-controlled code when imported. Trusting the current package-index result by name alone exposes the Agent to upstream compromise, malicious release replacement, account takeover, and unexpected behavior introduced by a later version.

The instruction also modifies the execution environment automatically after an import failure, without requiring explicit user approval.

Attack Path

1. The Agent invokes the skill in an environment where connectonion is absent.
2. The environment check raises ImportError.
3. Following the skill instructions, the Agent runs pip install connectonion.
4. The package index supplies whichever release is current at execution time.
5. If that release or its dependency chain is compromised, malicious code executes during installation or subsequent import.
6. The malicious dependency inherits the Agent's available filesystem, environment, credential, and network access.

Impact Assessment

A compromised dependency can execute arbitrary code with the privileges of the Agent process. It may ...[truncated 427 chars]

Remediation

View remediation

Remediation Suggestions

• Pin connectonion and all transitive dependencies to reviewed versions.
• Require cryptographic hashes for downloaded distributions, for example through a hash-locked requirements file.
• Use a trusted, explicitly configured package index.
• Prefer prebuilt, reviewed environments rather than runtime installation.
• Verify the publisher, artifact provenance, and release signatures where available.
• Install the dependency inside an isolated virtual environment with minimal privileges.
• Require explicit user approval before changing the environment.
• Perform dependency vulnerability and provenance scanning as part of release maintenance.
• Retest and republish the skill whenever the pinned dependency version changes.

Replace the unconstrained command with installation from an audited lockfile, such as:

bash

python -m pip install --require-hashes -r requirements.lock

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill instructs the agent to send user-provided task content, along with the local agent identity and signatures, to a remote agent and potentially through a relay, but it does not require an explicit warning or consent step before disclosure. In this context, that creates a real data-sharing risk because sensitive prompts, metadata, and identity information may be transmitted off-system to an untrusted external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The environment setup directs the agent to run installation and initialization commands such as pip install connectonion and co init, which modify the local system and create persistent identity material, without a clear safety notice or confirmation. This is dangerous because it can cause unintended package installation, state changes, and key generation on the host without informed user consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.