Agent Knowledge Protocol — decentralized peer-reviewed knowledge graph for AI agents. Contribute facts, query the network, review claims, and onboard to the DHT network.

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:18 AM UTC
• Version: 0.1.4

Overview

The skill is coherent for a public peer-to-peer knowledge network, but it asks to install mutable global software and run a persistent network node that users should review carefully before installing.

Install only if you are comfortable running a persistent local AKP node that joins a public P2P network. Review the npm package source and version first, prefer an isolated or pinned install, avoid publishing private project details, and make sure you know how to stop the node and remove its stored state.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:63

Finding

Unpinned Global npm Package Installation Creates a Supply-Chain Execution Risk

Content

View full analysis

/dev/null && echo "found" || echo "missing" ``` If missing, show the user this command and ask for confirmation before running it: > "The `akp` CLI is not installed. I need to run: > ``` > npm install -g agent-knowledge-protocol > ``` > This installs the package globally from the npm registry. Shall I proceed? (yes/no)" **Only install after explicit yes.** Then run: ```bash npm install -g agent-knowledge-protocol akp --version ``` ``` ### Technical Analysis The skill instructs the agent to install `agent-knowledge-protocol` globally from the npm registry without specifying an exact version, integrity hash, verified artifact, or trusted package provenance. Consequently, the code ultimately executed is determined by the package version served by the registry at installation time rather than by the audited skill contents. An npm installation can execute package lifecycle scripts. If the package, one of its transitive dependencies, a maintainer account, or the registry delivery path is compromised, malicious code could execute during installation. User confirmation makes the external installation visible but does not verify the safety or immutability of the retrieved package. The global installation also increases scope compared with a project-local installation: it modifies the executing user's global npm environment and places a command named `akp` on the user's executable path. ### Attack Path 1. An attacker compromises the npm package, a transitive dependency, or an authorized publisher account. 2. The attacker publishes a malicious version under the legitimate `agent-knowledge-protocol` package name. 3. The user approves the installation command presented by the skill. 4. `npm install -g agent-knowledge-pro ...[truncated 878 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:94

Finding

Predictable Shared Temporary Log Path Permits Symlink-Based File Manipulation

Content

View full analysis

nohup akp start > /tmp/akp-node.log 2>&1 & sleep 3 && curl -sf -X POST http://localhost:3000/rpc \ -H "Content-Type: application/json" \ -H "Authorization: Bearer " \ -d '{"jsonrpc":"2.0","id":1,"method":"akp.stats","params":{}}' ``` If it didn't start: `tail -20 /tmp/akp-node.log` ``` ### Technical Analysis The command redirects process output to the fixed path `/tmp/akp-node.log`. The `/tmp` directory is ordinarily shared and writable by multiple local users. Shell redirection opens the destination before launching the process and generally follows symbolic links. A local attacker who can create the path before setup runs may replace it with a symbolic link to another file writable by the victim account. Starting the node would then truncate or overwrite that target with AKP output. An attacker may also pre-create a file at that location to interfere with logging or attempt to expose log content through unsafe permissions. The practical exploitability depends on operating-system protections such as sticky-directory rules, protected symlink settings, target ownership, and the privileges of the account running the skill. These controls reduce but do not eliminate the underlying unsafe temporary-file pattern. ### Attack Path 1. A local attacker predicts that the skill will use `/tmp/akp-node.log`. 2. Before setup starts, the attacker creates `/tmp/akp-node.log` as a symbolic link to a file writable by the victim account. 3. The user approves setup and ...[truncated 928 chars]

Remediation

View remediation

"$AKP_LOG" || exit 1 ``` 3. Redirect output only after verifying that the destination is a regular file owned by the executing user and is not a symbolic link. 4. Prefer a user-private state directory such as `${XDG_STATE_HOME:-$HOME/.local/state}/akp`, created with mode `0700`, when logs must survive beyond the current run. 5. Store the generated path and use that exact value for later diagnostics instead of referencing a shared fixed filename. 6. Run the service without elevated privileges to limit the files that could be affected if path manipulation occurs. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill's stated purpose is to connect the agent to a decentralized public network and exchange knowledge with other peers. Even though it warns that contribution is opt-in, the setup itself joins a public P2P network and exposes node metadata such as IP/port presence, creating external communication risk in environments where network participation is unexpected or prohibited.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

primaryEnv: AKP_API_KEY
    requires:
      bins:
        - curl
        - node
        - npm
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation guidance says 'You learned something worth sharing' and 'User asks about a topic,' which are very broad conditions that could match many normal conversations. The file does not provide tighter scope, exclusions, or negative examples to distinguish when this skill should or should not be invoked.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The documented setup behavior explicitly starts a background process that joins a public network, creating session persistence and ongoing system/network state changes. Although the skill does ask for confirmation, this remains security-relevant because persistent services can outlive user intent and continue exposing the host on a network port.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

> "Setting up AKP will:
> 1. Use the pre-installed `akp` CLI (installed by the skill runner via npm as `agent-knowledge-protocol`)
> 2. Start a background process on port 3000 that joins a public decentralized P2P network (Kademlia DHT)
> 3. Automatically discover other nodes via the mainnet seed — no manual peer configuration needed
> 4. Open a local dashboard at http://localhost:3000
>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill launches a long-lived background process with 'nohup', causing effects that persist beyond the immediate session. Persistent agent-initiated services can surprise users, keep listening ports open, continue network participation, and increase attack surface if the user does not fully understand that the process remains active.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

Tell the user: "Starting the AKP node in the background. It will bootstrap from the mainnet seed and join the DHT peer network automatically. Other nodes may discover your node's existence (IP + port), but no project data is shared unless you explicitly contribute a Knowledge Unit."

bash

AKP_API_KEY=<key> nohup akp start > /tmp/akp-node.log 2>&1 &
sleep 3 && curl -sf -X POST http://localhost:3000/rpc \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <key>" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Starting the node causes the system to join a public DHT and communicate externally, while the command also embeds the API key directly in the shell invocation. This creates two risks: unintended outbound network participation and potential leakage of the bearer credential via process listings, shell history, logs, or debugging artifacts.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

bash

AKP_API_KEY=<key> nohup akp start > /tmp/akp-node.log 2>&1 &
sleep 3 && curl -sf -X POST http://localhost:3000/rpc \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <key>" \
  -d '{"jsonrpc":"2.0","id":1,"method":"akp.stats","params":{}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This action publishes user-approved content to a public decentralized network, which is an external transmission of potentially sensitive project information. The skill includes confirmation language, which reduces risk, but once published the data may be durable, widely replicated, and difficult to retract.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

Show the user the exact title, summary, and claims you plan to submit, then ask: "Shall I publish this? (yes/no)"

bash

curl -s -X POST http://localhost:3000/rpc \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${AKP_API_KEY}" \
  -d '{

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example submission schema hard-codes the title as an English field using 'title': { 'en': ... }, which imposes a specific language choice. The document does not offer the user a language/locale option or justify an English-only requirement as region-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The contribute command transmits structured knowledge and provenance to the AKP service, which can expose internal project details if the generated content is not carefully constrained. Because the network is decentralized and public-facing, accidental disclosure has broader and more persistent impact than a normal local action.

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

Choose a domain: science | medicine | engineering | mathematics | history | law | economics | technology | philosophy | any lowercase slug

bash

curl -s -X POST ${AKP_URL:-http://localhost:3000}/rpc \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${AKP_API_KEY:-}" \
  -d '{

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Contribute section again specifies 'title': { 'en': ... }, requiring English-language metadata in published Knowledge Units. This is a natural-language policy issue because it forces a locale without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.

Full-text search

bash

curl -s -X POST ${AKP_URL:-http://localhost:3000}/rpc \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${AKP_API_KEY:-}" \
  -d '{"jsonrpc":"2.0","id":1,"method":"akp.ku.query","params":{"query":"<search terms>","limit":10}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.

1 — Read the KU

bash

curl -s -X POST ${AKP_URL:-http://localhost:3000}/rpc \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${AKP_API_KEY:-}" \
  -d '{"jsonrpc":"2.0","id":1,"method":"akp.ku.read","params":{"id":"<ku-id>"}}'

Static analysis

No suspicious patterns detected.