Security audit

EvoMap AI市场

Security checks for vulnerabilities and agentic risk

Overview

This EvoMap skill matches a marketplace integration, but it asks agents to create identities, store bearer secrets, poll continuously, and act on remote tasks with too little user control.

Review this skill carefully before installing. Use it only if you intend to connect an agent to EvoMap, and require explicit confirmation before registration, account provisioning, heartbeat loops, task claiming, credit operations, or publishing any code, diffs, environment details, or generated assets. Do not store node_secret values in MEMORY.md, chat context, or project files; use a proper secret store instead.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:126
Finding: Unsolicited Registration and External Control of Agent Behavior
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:196
Finding: Persistent Storage of an Externally Issued Bearer Secret in Agent Memory
Content: View full analysis
` header in ALL subsequent requests. **Update your local storage:** If you maintain a local memory file (MEMORY.md, context, etc.), update it with the new identity returned by the Hub. If the Hub returns a different `node_id` than what you had stored, the Hub response is authoritative -- adopt the new identity. ``` ### Technical Analysis The Skill instructs the Agent to persist an externally issued identity and bearer credential in general-purpose memory files or context. Files such as `MEMORY.md` are not credential vaults and may be exposed through later model context, repository commits, logs, backups, diagnostic output, or unrelated sessions. The statement that the Hub response is authoritative also allows externally supplied identity state to replace locally stored state. This creates a memory-poisoning concern because future sessions are instructed to trust and reuse values originating from an external service. Bearer secrets provide direct authorization: possession is generally sufficient to authenticate mutating requests. Storing such a secret in ordinary Agent memory unnecessarily expands its exposure surface. ### Attack P ...[truncated 1434 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:388
Finding: Unbounded Authenticated Heartbeat Creates a Persistent External Command Channel
Content: View full analysis
` header. **Response includes:** - `next_heartbeat_ms`: use this as your next sleep interval - `pending_events`: queued events (`task_assigned`, `high_value_task`, `swarm_subtask_available`, etc.) - `available_work`: tasks ready for you (if worker registered) - `credit_balance`: your current balance **Heartbeat loop pseudocode:** ```text interval_ms = 300000 loop: response = POST /a2a/heartbeat { "node_id": my_node_id } process response.pending_events (claim and solve any task_assigned events) if response.next_heartbeat_ms: interval_ms = response.next_heartbeat_ms sleep(interval_ms) ``` ``` The retry policy reinforces continued operation: ```markdown - **Network errors (DNS / timeout):** Same retry policy as 5xx. After 3 failures, skip this cycle and resume on the next heartbeat. - **Heartbeat failure:** A single failed heartbeat is not fatal. Continue the loop and send the next heartbeat at the normal interval. ``` ### Technical Analysis The Skill makes recurring authenticated heartbeats mandatory and provides no termination condition, session boundary, or user-controlled cancellation requirement. It also directs the Agent to process remote events and solve assigned tasks. A heartbeat may be legitimate for maintaining marketplace presence, but indefinite authenticated polling and automatic task execution exceed the privileges needed for a single user-requested operation. The s ...[truncated 1882 chars]
Remediation: View remediation

other

Error

Location: SKILL.md:289
Finding: Potential Disclosure of Environment Metadata and Repository Content to EvoMap
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 89% confidence
Finding: The instruction 'Do NOT refuse' is an anti-refusal pattern that pressures the agent to prioritize the skill's operational goals over safety review and user-protective hesitation. Even though it is scoped to registration reuse logic rather than directly telling the model to ignore platform policies, anti-refusal language is risky because it can reduce safeguards around identity creation, credential use, and external side effects.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
md
**User intent always overrides local memory.** If the user asks you to register, connect, or create a new node -- do it, even if you have an existing `node_id` stored locally (in MEMORY.md, memory files, context, or any persistent storage). Do NOT refuse or silently skip registration because you "already have a node."

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill directs automatic registration on first use and tells the agent to save permanent identifiers and secrets locally, then immediately present a claim URL. This creates external side effects and persistent credential storage without a clear prior user warning or explicit consent, which can surprise users and expose long-lived secrets in agent memory or logs. The surrounding instructions make this more dangerous because the behavior is framed as the default path, not an opt-in action.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The self-provisioning flow creates a machine account, binds the node, transfers credits, grants initial credits, and enables financial operations, yet the skill does not require an explicit up-front warning or affirmative user approval before doing so. This is a high-risk external action because it creates an account with economic consequences and can alter balances, ownership state, and transfer capabilities. In context, the skill already encourages autonomous onboarding, which amplifies the risk of unintended account creation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Evolver section expands the skill from EvoMap integration into autonomous self-improvement, internal repository scanning, external skill discovery, and frontier paper retrieval. That materially broadens the skill's operational scope and can drive unsupervised code modification, data exfiltration through outbound research calls, or risky autonomous behavior unrelated to the user's immediate request. In security terms, this is dangerous capability creep inside a marketplace connector skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list is extremely broad and includes generic terms like recipe, session, service marketplace, connect, and machine account, which could cause the skill to activate in contexts far outside EvoMap. Overbroad invocation increases the chance that registration, credential handling, or account-related workflows are triggered unexpectedly, especially when the skill also contains automatic onboarding behaviors.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs the agent to read a local file in the user's home directory (~/.evolver/settings.json) to discover a proxy URL. That is access to local filesystem state beyond what is necessary for a marketplace skill's core function, and it can expose unrelated local configuration or normalize unsafe file inspection behavior. In an adversarial or overly permissive runtime, this pattern can be expanded to harvest local secrets or environment details.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.