Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent P2P sharing purpose, but it grants high-impact file sharing and memory-ingestion authority with weak local controls and under-disclosed network exposure.
Install only in a contained environment and avoid sharing sensitive files. Treat the tracker as public, prefer HTTPS/private trackers, do not use the safety-skip option, and do not run the background seeder on a multi-user system until the control socket permissions and handler templating are fixed.
SKILL.md:30Remote Installer Is Downloaded and Executed Without Integrity Verification
skill.json:25Shell Command Injection Through Unescaped Skill Handler Parameters
src/seeder_daemon.py:292World-Writable Seeder Control Socket Allows Unauthorized File Seeding and Daemon Control
src/logic.py:347Semantic File Metadata Is Transmitted to a Remote Tracker Over Plaintext HTTP
The dependency cryptography==46.0.4 is flagged with numerous advisories, including issues affecting bundled OpenSSL and PKCS#7 processing. Because this skill performs P2P file sharing and likely relies on secure transport, identity, or signature validation, weaknesses in cryptographic processing can undermine confidentiality, integrity, and trust decisions across the system.
transformers==5.0.0 is associated with multiple severe advisories, including reported remote code execution and path traversal during model initialization and save/load operations. In this skill's context—semantic search with Hugging Face ecosystem components and likely remote model acquisition—this is especially dangerous because attacker-controlled model repositories or artifacts could trigger code execution or arbitrary file writes.
cryptography==46.0.4 is reported with multiple critical advisories, including issues in bundled OpenSSL and PKCS#7 processing, so keeping this version pinned creates a real cryptographic attack surface. For a P2P file-sharing skill that likely relies on secure transport, identity, signatures, or encrypted artifacts, weaknesses in cryptographic validation or decryption can directly undermine confidentiality, authenticity, and trust between agents.
transformers==5.0.0 is flagged with multiple critical advisories including remote code execution and path traversal, which are especially severe in ML systems that fetch or initialize models dynamically. In this skill, semantic search likely depends on external models or tokenizers, so a malicious model repository, crafted artifact, or peer-influenced model path could lead to arbitrary code execution or unauthorized file writes.
The available commands include identity setup, and the static finding indicates key generation and persistence, but the top-level description does not mention identity management or OpenSSL-backed cryptographic operations. Undisclosed credential material generation and storage can expose users to accidental secret leakage, improper permissions, or misuse of trust identities.
The available commands include identity setup, and the static finding indicates key generation and persistence, but the top-level description does not mention identity management or OpenSSL-backed cryptographic operations. Undisclosed credential material generation and storage can expose users to accidental secret leakage, improper permissions, or misuse of trust identities.
The available commands include identity setup, and the static finding indicates key generation and persistence, but the top-level description does not mention identity management or OpenSSL-backed cryptographic operations. Undisclosed credential material generation and storage can expose users to accidental secret leakage, improper permissions, or misuse of trust identities.
The available commands include identity setup, and the static finding indicates key generation and persistence, but the top-level description does not mention identity management or OpenSSL-backed cryptographic operations. Undisclosed credential material generation and storage can expose users to accidental secret leakage, improper permissions, or misuse of trust identities.
The available commands include identity setup, and the static finding indicates key generation and persistence, but the top-level description does not mention identity management or OpenSSL-backed cryptographic operations. Undisclosed credential material generation and storage can expose users to accidental secret leakage, improper permissions, or misuse of trust identities.
The available commands include identity setup, and the static finding indicates key generation and persistence, but the top-level description does not mention identity management or OpenSSL-backed cryptographic operations. Undisclosed credential material generation and storage can expose users to accidental secret leakage, improper permissions, or misuse of trust identities.
The available commands include identity setup, and the static finding indicates key generation and persistence, but the top-level description does not mention identity management or OpenSSL-backed cryptographic operations. Undisclosed credential material generation and storage can expose users to accidental secret leakage, improper permissions, or misuse of trust identities.
The available commands include identity setup, and the static finding indicates key generation and persistence, but the top-level description does not mention identity management or OpenSSL-backed cryptographic operations. Undisclosed credential material generation and storage can expose users to accidental secret leakage, improper permissions, or misuse of trust identities.
The available commands include identity setup, and the static finding indicates key generation and persistence, but the top-level description does not mention identity management or OpenSSL-backed cryptographic operations. Undisclosed credential material generation and storage can expose users to accidental secret leakage, improper permissions, or misuse of trust identities.
Piping downloaded content directly into sh removes the opportunity to review or validate what will execute and is a classic command-chaining anti-pattern. In an agent or automation context, this makes silent remote code execution especially dangerous because the fetched script can perform arbitrary filesystem, network, or process actions immediately.
# 1. Install uv
curl -LsSf https://astral.sh/uv/install.sh | sh
# 2. Navigate to Synapse directory
cd /path/to/HiveBrain/Synapse
The project pins click==8.3.1, and the supplied advisory indicates versions at or below 8.3.2 are affected by command injection. In an agent skill that may expose CLI-style inputs or automation hooks, a command injection flaw in a core command parsing library can materially increase the risk of arbitrary command execution if reachable.
The pinned idna==3.11 version is reported vulnerable to specially crafted IDNA inputs. In a networked skill that may communicate with peers, trackers, model hubs, or remote search endpoints, incorrect handling of internationalized domain names can enable hostname confusion, validation bypass, or misrouting of connections.
torch==2.10.0 is reported vulnerable, including a memory-corruption issue in torch.jit.script. Since this skill uses ML embeddings and likely processes untrusted models, tensors, or serialized ML artifacts, a vulnerable PyTorch runtime raises the risk of crashes, denial of service, or potentially code execution in model-processing workflows.
urllib3==2.6.3 is flagged for multiple HTTP client issues, including decompression-bomb protection bypass and sensitive header forwarding across origins. Because this skill is network-heavy and likely performs outbound HTTP(S) requests to peers or model infrastructure, these flaws could enable denial of service or credential/header leakage during redirects or proxy interactions.
The pinned dependency click==8.3.1 is flagged with a high-severity command injection advisory, which is a genuine supply-chain risk when an application exposes CLI-driven workflows or passes untrusted input into Click-based command handling. In this skill, the agent-to-agent and file-sharing context increases risk because external peers, filenames, metadata, or search parameters may eventually flow into command interfaces or wrappers, making exploitation paths more plausible.
idna==3.11 is flagged for vulnerabilities involving specially crafted internationalized domain inputs, which can affect hostname parsing, validation, or canonicalization. In a distributed networking skill that may connect to trackers, peers, model registries, or remote APIs, incorrect IDNA handling can enable spoofing, misrouting, or security control bypass when attacker-controlled hostnames are processed.
torch==2.10.0 is flagged for memory corruption and other high-severity issues, and PyTorch has a history of dangerous behavior when handling untrusted models, JIT artifacts, or complex serialized inputs. Because this skill uses semantic search and embeddings, it likely loads models or model-related assets; if any of those can be influenced by remote peers or external registries, the vulnerability becomes significantly more dangerous.
urllib3==2.6.3 is flagged for issues including decompression-bomb safeguard bypass and sensitive header forwarding across origins, both of which are real concerns in HTTP client code. This skill's network-heavy design increases exposure because it likely communicates with multiple remote services and peers, so redirect handling, proxy behavior, and streaming of attacker-controlled content can materially affect confidentiality and availability.
The skill can integrate a downloaded shard directly into the agent's active memory database and even exposes a 'skip_safety_check' option, yet the manifest lacks a prominent warning that this operation mutates the target database with untrusted external content. In a memory-sharing skill, this is especially dangerous because poisoned or adversarial embeddings/documents can contaminate retrieval behavior, persist malicious instructions, corrupt knowledge quality, or cause long-lived data integrity issues.
The assimilate API exposes skip_safety_check, allowing untrusted memory shards to bypass the only content-based guardrail before being merged into active agent memory. In this skill's context—P2P file sharing plus semantic memory ingestion—that materially increases the chance of prompt injection, malicious instructions, poisoned knowledge, or hostile metadata reaching downstream agent behavior.
Args:
shard: The MemoryShard to assimilate
target_db_path: Path to the agent's vector database
skip_safety_check: Skip safety scan (NOT RECOMMENDED)
merge_strategy: How to merge ('append', 'replace', 'upsert')
Returns:
The log message confirms the system will proceed 'without guardrails' when safety checks are skipped, reflecting a real unsafe execution path rather than harmless wording. Because this module is specifically responsible for transitioning downloaded external content into 'Active Memory', bypassing checks directly undermines the trust boundary and can enable ingestion of malicious or incompatible content.
f"Safety scan warnings: {', '.join(safety_report.warnings)}"
)
else:
logger.warning("Safety check SKIPPED - proceeding without guardrails!")
safety_report = None
# Step 4: Merge to local database
No suspicious patterns detected.