BLE → $ANIMA Minter

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:45 AM UTC
• Version: 1.0.0

Overview

This skill openly scans nearby Bluetooth device identifiers, but it stores and prints trackable data without clear consent, retention, or sharing controls.

Review before installing. Only run this where you are authorized to scan nearby BLE devices, preferably in an isolated environment. Expect raw Bluetooth MAC addresses to appear in terminal logs and deterministic hashes to be saved locally; delete anima_dag.gpickle and logs when no longer needed. Treat any future gossip-sync feature as sensitive sharing of nearby-device observations unless it adds explicit opt-in and limits. Pin and review dependencies before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Unpinned and integrity-unverified dependencies
Risk Level: Medium

Vulnerable Code

text

aioblescan
networkx

SKILL.md:15-18 instructs users to install these dependencies directly:

bash

pip install -r requirements.txt
python anima_minter.py

Technical Analysis

Neither dependency has an exact version constraint or cryptographic hash. Consequently, installation resolves whichever compatible release the configured package index provides at that time. This makes installations non-reproducible and prevents users from verifying that downloaded distributions match versions reviewed by the project.

If a dependency release or configured package repository is compromised, package installation hooks or imported runtime code could execute in the user's environment. The project does not itself establish that either named package is currently malicious; the issue is the absence of dependency version and integrity controls.

Attack Path

1. An attacker compromises a future release, distribution artifact, maintainer account, or package repository associated with a dependency.
2. A user follows the documented command pip install -r requirements.txt.
3. Pip resolves and downloads the attacker-controlled release because no reviewed version or artifact hash is required.
4. Malicious installation hooks execute during installation, or malicious module code executes when anima_minter.py imports the package.
5. The payload operates with the permissions of the user performing the installation or running the script.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. Depending on those privileges, an attacker could access user-readable files, credentials, Bluetooth resources, and network services or modify files owned by the user. If installat ...[truncated 167 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version.
2. Generate a lock file that also fixes transitive dependency versions.
3. Record cryptographic hashes for approved distributions and install with pip's --require-hashes option.
4. Retrieve packages only from a trusted, explicitly configured package index.
5. Add automated dependency vulnerability and provenance scanning to the release process.
6. Review and update pinned versions through a controlled process rather than accepting new releases automatically.
7. Perform installation and execution as an unprivileged user in an isolated virtual environment.

T09 · Insecure Skill Coding Practices

Warning

• Location: anima_minter.py:11

Finding

BLE Device Identifiers Are Logged in Plaintext and Weakly Pseudonymized

Content

View full analysis

Vulnerability Details

File Location: anima_minter.py:11-34
Vulnerability Type: Sensitive identifier exposure and reversible pseudonymization
Risk Level: Medium

Vulnerable Code

python

SALT = "anima2026"

def hash_mac(mac: str) -> str:
    salted = (mac + SALT).encode("utf-8")
    return hashlib.sha256(salted).hexdigest()

def store_to_dag(mac_hashes):
    G = nx.DiGraph()
    timestamp = datetime.utcnow().isoformat()
    for h in mac_hashes:
        G.add_node(h, timestamp=timestamp)
    nx.write_gpickle(G, "anima_dag.gpickle")
    print(f"Stored {len(mac_hashes)} nodes to anima_dag.gpickle")

async def main():
    mac_hashes = set()

    def callback(data):
        ev = aiobs.HCI_Event()
        ev.decode(data)
        mac = ev.retrieve("peer")
        if mac:
            mac_str = str(mac[0].val)
            h = hash_mac(mac_str)
            mac_hashes.add(h)
            print(f"Detected MAC: {mac_str} → Hash: {h}")

Technical Analysis

Every detected BLE MAC address is printed directly to standard output together with its hash. Terminal capture, service logs, redirected output, or other logging infrastructure can therefore retain raw identifiers beyond the scan.

The stored value is calculated using SHA-256 with the hardcoded string anima2026. A public constant is not a secret cryptographic key. MAC addresses have a structured and enumerable input space, allowing an attacker who obtains anima_dag.gpickle to hash candidate addresses with the known constant and compare the results offline. The deterministic construction also produces the same hash for the same address across different runs, enabling correlation over time.

This is pseudonymization rather than effective anonymization. The script provides no access controls, configurable retention policy, or deletion mechanism for the generated file.

Attack Path

1. The script scans nearby BLE advertiseme ...[truncated 1075 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove raw MAC addresses from normal console output. If diagnostics are necessary, make them explicitly opt-in and redact identifiers.
2. Replace the public salted hash with HMAC-SHA-256 using a randomly generated secret key stored outside the source code with restrictive permissions.
3. Rotate the HMAC key or use per-session identifiers when correlation between separate scans is not required.
4. Store only the minimum data required for the documented purpose and define an automatic retention and deletion policy.
5. Write output files to an explicitly selected private directory and apply owner-only file permissions.
6. Inform users that nearby device identifiers are collected and obtain appropriate authorization or consent before scanning.
7. Document that even keyed pseudonyms may remain sensitive and must not be treated as anonymous data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly advertises scanning nearby BLE MAC addresses, hashing them, storing the derived identifiers locally, and optionally gossip-syncing them, but provides no warning, consent flow, or privacy disclosure. Even if MACs are hashed, they originate from third-party device identifiers and can still create trackable pseudonymous records, especially when persisted or shared across nodes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code performs active BLE scanning, extracts nearby device identifiers, derives stable salted hashes from those identifiers, and persists them to disk. Even though raw MAC addresses are transformed, the use of a hardcoded static salt makes the hashes linkable across runs and enables long-term tracking of nearby devices, creating a meaningful privacy risk without any consent, notice, retention control, or access restrictions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The dependency 'aioblescan' is specified without a version constraint, which makes builds non-reproducible and allows future upstream releases to be pulled in automatically. If a malicious, compromised, or breaking release is published, installations may introduce vulnerable or unexpected code into the skill environment.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

aioblescan
networkx

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The dependency 'networkx' is unpinned, so installations may resolve to different versions over time, including newly published versions that have not been tested or security-reviewed for this skill. This creates supply-chain and stability risk because compromised or incompatible upstream updates can be introduced silently.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

aioblescan
networkx

Static analysis

No suspicious patterns detected.