Reed Agent Network

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:37 AM UTC
• Version: 0.2.2

Overview

The skill is mostly coherent as a Discord/GitHub agent-network tool, but it persists remotely mutable instructions and performs broad shared-state mutations without enough user control.

Install only if you intentionally want this skill to control a shared agent registry through the configured GitHub repository and Discord channel. Before use, review references/git-config.json, use a dedicated clean repository/worktree, avoid letting it edit MEMORY.md automatically, and require human approval for constitution changes, pushes, admin removals, and any rollback after sync failure.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/network.py:55

Finding

Remote Constitution Establishes Persistent Instruction and Memory Override

Content

View full analysis

Agent Network 统一宪章（Single Source of Truth）\n" "> 本文件是多 Agent 网络共享记忆与硬规则唯一来源。\n\n" "## 1) 基本规则\n" "1. Reed 为最高优先级指令源。\n" "2. 冲突时以 Reed 最新明确指令为准。\n" "3. 核心配置改动必须先审批后执行。\n" ) touched = True ``` ```python def ensure_memory_index(repo_path): workspace_root = os.path.dirname(os.path.dirname(BASE)) memory_path = os.path.join(workspace_root, "MEMORY.md") if not os.path.exists(memory_path): return {"updated": False, "reason": "MEMORY.md not found", "path": memory_path} canonical = os.path.join(repo_path, "AGENT_CONSTITUTION.md") start = "" end = "" block = ( f"{start}\n" "## Agent Network Constitution（Single Source of Truth）\n" f"- Canonical file: `{canonical}`\n" "- All agents must read this file before responding in group/network contexts.\n" "- If conflict exists between local memory notes and this constitution, constitution wins.\n" "- Do not duplicate full constitution text in `MEMORY.md`; keep only index + effective-date notes.\n" f"{end}\n" ) with open(memory_path, "r", encoding="utf-8") as f: content = f.read() if start in content and end in content: before = content.split(start)[0] after = content.split(end, 1)[1] ...[truncated 3131 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/network.py:232

Finding

Administrative Registry Operations Lack Authorization Enforcement

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/network.py:94

Finding

Failed Synchronization Can Destructively Reset Unrelated Repository State

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The mutation flow automatically pulls, edits registry state, commits, pushes, and on push failure performs a hard reset to HEAD~1. This combines silent remote state changes with a destructive rollback primitive, which can discard local work and make registry operations hazardous in shared or multi-purpose repositories.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill describes and relies on sensitive capabilities including shell execution, file reads/writes, Git operations, and Discord message sending, but it does not declare any explicit tool scope or permission boundary. In a multi-agent coordination skill that modifies shared state and publishes to external channels, missing scope increases the chance of unintended or overbroad execution and makes it harder for users or policy layers to constrain what the skill may do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill states that init will automatically create AGENT_CONSTITUTION.md and modify the workspace MEMORY.md, but it does not prominently warn the user before altering local files. Automatic writes to canonical memory/rules files are risky because they can overwrite trusted context, persist unintended instructions, and surprise operators in a security-sensitive agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill mandates git pull/commit/push and immediate Discord publication on every registry mutation without an explicit user warning that changes will be propagated to shared remote state and external messaging channels. In this context, the risk is elevated because a mistaken or malicious update can rapidly affect all participating agents, leak metadata, or poison the shared registry and constitution workflow across gateways.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/network.py (reported line 31)May include surrounding context.

python

def git(cmd, cwd, check=False):
    r = subprocess.run(["git", *cmd], cwd=cwd, capture_output=True, text=True)
    if check and r.returncode != 0:
        raise RuntimeError(r.stderr.strip() or r.stdout.strip() or f"git {' '.join(cmd)} failed")
    return r

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

ensure_repo() can clone a repository, create files, commit them, and push to the remote branch automatically, all without an explicit warning or confirmation step. This is dangerous because a routine initialization command can modify local state and publish changes to a remote repository, potentially leaking data, overwriting expected state, or changing shared governance documents unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The generated AGENT_CONSTITUTION.md content is written in Chinese and the script does not offer any language selection, opt-in, or justification for this locale constraint. That creates a natural-language policy concern because the skill implicitly imposes a specific language on downstream users or agents.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script edits a workspace-level MEMORY.md outside the declared GitHub registry state, creating side effects beyond the skill's stated purpose. In an agent setting, modifying shared memory/instructions can influence future agent behavior, effectively persisting policy changes in a location other tools may trust without the user's awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script rewrites workspace MEMORY.md without an explicit warning, even though that file may act as persistent shared context for agents. Silent modification of a memory or instruction file can alter downstream agent decisions and create hard-to-audit persistence outside the advertised registry mechanism.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The example task message is written in Chinese, and the skill does not state that language is optional or region-specific. Because the instructions define a natural-language protocol for inter-agent communication, this can be read as imposing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.