Security audit

synapse

Security checks across malware telemetry and agentic risk

Overview

Synapse appears to be a real P2P sharing skill, but it exposes local files and semantic metadata through trackers and runs a background seeder with weak local controls.

Install only if you intend to run a P2P file-sharing node. Do not share confidential, regulated, or proprietary memory/files; prefer trusted HTTPS trackers; inspect the uv installer/dependencies; and consider patching or restricting the seeder socket before use. Monitor and stop the background daemon when finished, and verify downloaded shards before any assimilation into an agent memory store.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (41)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation exposes substantial capabilities including shell execution, network access, environment variable use, and file read/write, yet no permissions are declared. This weakens informed consent and prevents policy engines or users from understanding the true operational scope before installation and use.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The documented purpose frames the skill as simple P2P sharing and semantic search, but the behavior includes identity generation, signing, reputation handling, daemon control, local scanning workflows, and tracker API interactions. This mismatch can cause users or automated systems to grant trust under a narrower threat model than the skill actually requires, increasing risk from hidden persistence, metadata processing, and network communication.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill can start, stop, and restart a separate local daemon process, creating persistent background behavior beyond a simple one-shot file sharing action. In an agent skill context, daemon management increases operational scope and can enable unintended long-lived services, resource use, and follow-on abuse if invoked without clear user consent.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The identity setup command launches a separate Python script, adding code-execution capability that exceeds the core stated purpose of P2P sharing/search. Even though the target script path is locally constructed, this broadens the attack surface and allows the skill to perform arbitrary secondary logic outside the current process under the user's privileges.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: In fallback mode, the code marks the session as complete/seeding and returns a file path even though no file contents were fetched. Consumers may trust the returned path as a valid downloaded shard and proceed to process a nonexistent, stale, or attacker-controlled local file, causing integrity failures and unsafe downstream behavior.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The submission path does not actually verify cryptographic signatures; it only checks whether a signature field is present, and callers can disable even that minimal check. In a decentralized reputation system, this allows forged or tampered attestations to be accepted and persisted, enabling reputation poisoning and trust manipulation across agents.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The client can start, stop, and force-kill a background daemon, including writing and later trusting a PID file under the user's home directory. In an agent-skill context, undisclosed lifecycle control over background processes expands the skill's capabilities beyond simple file sharing and can be abused for persistence, stealthy execution, or termination of unintended processes if the PID file is stale or tampered with.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The daemon binds a Unix socket and then sets its mode to 0o666, allowing any local user process to connect and issue control commands. Because the command interface includes shutdown, add/remove shard, and listing seeded file paths, this becomes an unauthorized local control channel rather than a simple IPC mechanism.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The IPC handler accepts arbitrary JSON requests and directly performs sensitive actions with no authentication, authorization, or validation of caller identity. A local attacker can inspect seeded content metadata, remove torrents, add attacker-chosen files for seeding if the daemon has access, or shut the service down entirely.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The heartbeat instructions include automatic pruning of completed downloads older than 7 days without any mention of user notice, confirmation, retention policy visibility, or scope of deletion. In a P2P file-sharing skill, silent deletion can cause unexpected data loss and may remove evidence, shared artifacts, or user-expected content, making the behavior unsafe even if operationally intended.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill describes posting magnet links to a community tracker without any privacy disclosure, consent flow, or explanation that doing so publicly advertises shared content and network participation. In this skill's context, magnet links for memory shards may expose sensitive knowledge domains, user interests, or proprietary data and can increase discoverability of content beyond the user's intended audience.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README promotes automatic tracker registration and a persistent background seeder while omitting clear warnings that shared files, metadata, and ongoing network participation may be exposed to third parties. In a P2P file-sharing skill, this can cause users or downstream agents to unintentionally publish sensitive content or maintain unexpected inbound/outbound connectivity, increasing privacy and operational risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: A P2P sharing and semantic search tool inherently transmits filenames, hashes, embeddings, search queries, tracker registrations, and possibly content-derived metadata over the network. Omitting a clear warning may lead users to expose sensitive files or queries without understanding the privacy and confidentiality implications.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The installation instructions recommend piping a remote script directly into the shell, which allows arbitrary code execution from a network source without prior inspection. If the install endpoint, transport path, or upstream distribution is compromised, users can immediately execute attacker-controlled code on their systems.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The manifest exposes broadly described tools for exporting, distributing, downloading, and assimilating agent memory without clear activation constraints, trust boundaries, or user-consent requirements. In an agent environment, vague descriptions can cause over-broad invocation by higher-level planners or users, leading to unintended exfiltration of local vector databases or ingestion of untrusted network content.

Natural-Language Policy Violations

Low

Confidence: 96% confidence
Finding: The skill explicitly supports sharing portions of an agent's vector database over a P2P network and downloading third-party shards, yet the manifest contains no user opt-in, policy gating, or locality/privacy qualifiers. Because agent memory may contain sensitive prompts, documents, embeddings, or derived secrets, this context makes silent sharing and redistribution materially dangerous even if the feature is intentional.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The assimilate() pipeline accepts skip_safety_check=True and will merge unscanned shards directly into the local database after only validation and model-alignment checks. In this skill's context—P2P file sharing with semantic memory ingestion—this materially increases the risk of importing adversarial content, prompt-injection payloads, poisoned embeddings, or malicious metadata into an agent's active knowledge base.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The example code downloads a shard from a P2P source and then assimilates it into a local database path, which modifies persistent local state. Although the example performs compatibility and safety checks first, it does not provide an explicit user confirmation or strong warning before writing untrusted network-derived data into local agent memory, making accidental or unsafe ingestion more likely.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code writes the ML-DSA private key PEM to a named temporary file on disk before calling OpenSSL, creating an avoidable exposure window for highly sensitive key material. Even though cleanup is attempted, crashes, debugging access, insecure temp-directory permissions, backup/forensic recovery, or other local compromise scenarios could leak the private key and permanently break identity trust.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The share command reads file content, derives an embedding, and sends that embedding plus metadata such as tags, file size, display name, and optional identity fields to a remote tracker without an explicit warning or opt-in at the transmission point. Embeddings and metadata can leak sensitive semantic information about the shared file, especially in an agent environment where the operator may not realize tracker registration exposes derived content externally.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The search command converts user query text into an embedding and posts it to an external tracker by default. Query embeddings can still reveal sensitive intent or proprietary topics, and the default remote endpoint makes this data exfiltration easy to trigger without a strong disclosure boundary.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code derives semantic embeddings from file content and transmits them, along with creator metadata, to trackers via HTTP(S) automatically. Embeddings can leak sensitive characteristics of the underlying file, and plain HTTP trackers allow interception or tampering in transit, making this especially risky in a P2P file-sharing skill handling potentially private agent memory shards.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: Daemon startup occurs silently via subprocess creation and PID-file persistence with no user-facing disclosure at the action point. In an agent environment, silently creating a resident background process can undermine user expectations, reduce detectability of long-lived activity, and increase the risk of unintended persistence or misuse.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The force-stop path trusts a PID file and may send SIGTERM to that PID, then delete the PID file, without strong validation or user confirmation. If the PID file is stale, corrupted, or replaced, the code could terminate an unrelated process owned by the user, making this a potentially destructive local action.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The world-writable socket exposes a hidden control surface to any local process without any user-facing warning, making external manipulation of seeding operations possible. In this skill's context, the daemon manages P2P distribution and persistent state, so undisclosed external control increases the risk of misuse and operational surprise.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.