T09 · Insecure Skill Coding Practices
Error
- Location
evomap_main.py:13- Finding
Hardcoded EvoMap Credentials Used as Default Authentication
- Content
View full analysis
- Remediation
View remediation
Security audit
EvoMap Dashboard
Security checks for vulnerabilities and agentic risk
Overview
This dashboard mostly behaves like an EvoMap viewer, but it ships hardcoded credentials, exposes an unauthenticated local proxy, and includes an unrelated publishing script that can write to EvoMap.
Install only if you are prepared to audit and modify it first: remove and rotate the embedded EvoMap secret, delete or isolate publish.py, bind the server to localhost, restrict CORS, require explicit user-provided credentials, and treat any Node Secret entered into the dashboard as sensitive account authority.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
evomap_main.py:19- Finding
Network-Exposed Unauthenticated Proxy with Wildcard CORS
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
evomap_dashboard.html:248- Finding
Remote-Content DOM XSS Can Expose the Node Secret
- Content
View full analysis
'' ).join(''); ``` Remote task fields are also concatenated into HTML: ```javascript document.getElementById('tasksBody').innerHTML = tasks.map(t=> ''+ts(t.created_at||'')+''+ ''+statusBadge(t.status)+''+ ''+(t.asset_id||'-')+'' ).join(''); ``` Remote asset fields are handled in the same way: ```javascript document.getElementById('assetsBody').innerHTML = items.map(a=> ''+ ''+b('b', a.asset_type||'-')+''+ ''+(a.signal||a.trigger_text||a.domain||'-')+''+ ''+((a.confidence||0)*100).toFixed(1)+'%'+ ''+statusBadge(a.status)+''+ ''+ts(a.created_at)+'' ).join(''); ``` ### Technical Analysis The dashboard treats EvoMap API data as trusted HTML. Fields including `status`, `asset_id`, `asset_type ...[truncated 2173 chars]'+v+''+l+'- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
publish.py:203- Finding
Bundled Undeclared Script Performs Authenticated Bulk Publishing
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:21- Finding
Unverified Prebuilt Executable and Unpinned Installation Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the code actually performs authenticated write operations to https://evomap.ai using hardcoded credentials and submits predefined assets, then the skill is not a viewer at all but a disguised remote publisher. That is highly dangerous because users or agents may invoke it expecting passive inspection, while it can make unauthorized state-changing requests to a third-party service and abuse stored credentials.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the code actually performs authenticated write operations to https://evomap.ai using hardcoded credentials and submits predefined assets, then the skill is not a viewer at all but a disguised remote publisher. That is highly dangerous because users or agents may invoke it expecting passive inspection, while it can make unauthorized state-changing requests to a third-party service and abuse stored credentials.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The UI explicitly tells users that credentials are only used locally, but the code later transmits the Node Secret in an Authorization header to backend endpoints. This is a deceptive security claim that can cause users to disclose sensitive credentials under false assumptions, especially since the skill is specifically designed to collect a Node ID and Node Secret and use them against a service.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The footer repeats the false assurance that credentials are only used locally even though fetch requests send the secret over the network in request headers. Repeating the claim increases the likelihood that users trust the page and enter sensitive node credentials they might otherwise withhold.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module documentation states that any node credentials can be supplied via headers, but the implementation instead substitutes built-in credentials when headers are absent. In security-sensitive tooling, misleading documentation is dangerous because operators may believe they are viewing only their own node while the app can silently access a different account or remote identity.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code embeds a default Node ID and Node Secret and silently uses them whenever the caller omits headers, despite claiming to work with arbitrary user-supplied credentials. This creates unauthorized access risk, can expose a real account or service identity to anyone who runs the dashboard, and hides the fact that outbound requests may be made under privileged built-in credentials.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A hardcoded secret is present in source and is automatically used for outbound Authorization headers. Hardcoded credentials are inherently sensitive because they can be extracted from the code, reused by anyone with access to the skill, and may grant ongoing access to a real remote service account.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The file hardcodes a bearer secret directly in source and uses it for authenticated requests. Embedded credentials are highly dangerous because anyone with access to the skill can recover and abuse the secret to impersonate the node, publish data, or access associated remote services.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script contains a hardcoded batch of prewritten capsules about unrelated topics and iterates over them for publication, which has no legitimate connection to viewing local node status. This indicates the skill is being used to surreptitiously submit content to a remote service rather than provide the advertised dashboard behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill metadata claims it launches a local dashboard viewer, but this code instead sends a POST request to a remote EvoMap hub. That mismatch is dangerous because it can exfiltrate data and perform unauthorized remote actions under the guise of a harmless local-viewing capability.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises and instructs the user to launch a FastAPI service that makes outbound requests to EvoMap, but it declares no explicit tool scope or permissions. In an agent environment, undeclared network capability weakens policy enforcement and transparency, making it easier for a seemingly local viewer to perform remote actions or exfiltrate sensitive data such as Node credentials.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The invocation text is broad enough that an agent may select this skill for generic requests about viewing EvoMap status, even though the skill asks for highly sensitive Node Secret credentials and may have hidden remote behavior. Overbroad routing increases the chance of accidental credential exposure or unintended execution in situations where a safer read-only or browser-native path should be used.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to enter a Node Secret into the dashboard without a prominent warning about the sensitivity of that credential, its privilege level, or the risks of using third-party code/executables. In context, this is more dangerous because the skill is sourced from an external repository and the surrounding claims about safety and locality could cause users to disclose secrets too readily.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The HTML root sets
lang="zh", and the interface text and date/time formatting are consistently hard-coded to Chinese locales. This is a natural-language policy concern because the skill imposes a specific language/locale on all users without opt-in or an explanation that it is intended only for a Chinese-speaking or region-specific audience.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The app enables CORS for all origins, methods, and headers while also exposing proxy endpoints that forward authentication material to a remote API. In a local service context, this allows any website visited by the user to issue browser requests to the local dashboard and abuse it as a cross-origin bridge to EvoMap APIs, increasing the chance of credential misuse or unintended data access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The proxy endpoints accept an Authorization header from the caller and forward its bearer token to the external EvoMap service, with no user-facing indication that local dashboard requests result in credential transmission off-host. In the context of a browser-accessible local service, this can mislead users about trust boundaries and make token leakage or unintended remote actions more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description explicitly claims the skill can view any EvoMap node data using any Node ID and Node Secret combination, without invite code access. This is an overly broad capability statement that suggests bypass of normal access controls and unauthorized access to sensitive node information, making the description itself a strong indicator of abusive or unsafe functionality.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
A local dashboard viewer should not need a remote publish capability, especially one that constructs envelopes, asset IDs, and sends authenticated requests to an external hub. In this context, the unjustified remote capability increases the risk of covert data transmission and unauthorized use of node credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code transmits capsule contents, sender_id, timestamps, and environment-identifying metadata to a remote endpoint without clear disclosure or consent. Even if the payload is not overtly sensitive, sending authenticated outbound data from a supposedly local viewer violates user expectations and can leak operational or identifying information.
- Content