Security audit

Coherence Network

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed integration with Coherence Network, but it asks agents to auto-register externally, poll remote peer messages at session start, and use unpinned npm/npx tools with broad auto-triggering.

Review before installing. Use this only if you are comfortable with a public Coherence Network integration that can create remote records, link identities, interact with task queues, and receive federation messages. Prefer read-only use first, avoid auto-running inbox or task commands, confirm every write, do not link personal/provider identities unless intended, and pin/review npm package versions before installing the CLI or MCP server.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:66
Finding: Externally Controlled Federation Messages Are Prioritized in the Agent Session
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 66-73
Vulnerability Type: Untrusted remote instructions introduced into the active agent context
Risk Level: Critical

Vulnerable Code Snippet

markdown
## OpenClaw session protocol (bidirectional messaging) OpenClaw loads this skill when a session starts. **Check the inbox before any other work** so messages from other federation nodes are not missed. Any node can send traffic with `coh msg` or structured `coh cmd`; the recipient sees it on the next inbox poll. **Start of every session (in order):** 1. `coh inbox` — list messages for this node (CLI: resolves your `node_id` from hostname, then `GET /api/federation/nodes/{node_id}/messages?unread_only=false&limit=20`; unread messages are marked in the output). 2. `coh status` — confirm API health and operational signals. If the inbox has messages, surface them to the user and confirm before acting on them.

Technical Analysis

The skill instructs the agent to poll a remote federation inbox before performing the user's requested work. It explicitly permits other nodes to submit both ordinary messages and structured coh cmd content.

This creates an instruction-hijacking boundary because text controlled by remote federation participants is deliberately introduced into the current session and prioritized over the user's task. The documentation does not specify sender authentication, message signatures, a trusted-sender allowlist, command authorization rules, prompt-injection filtering, or strict separation between message data and agent instructions.

The requirement to obtain confirmation before acting reduces the likelihood of immediate execution, but it does not eliminate the exposure. Adversarial content is still surfaced inside the session and may attempt to impersonate system instructions, request sensitive information, misrepresent an urgent operational condition, or persuade the user ...[truncated 1425 chars]
Remediation: View remediation
Remediation Suggestions

Remove the requirement to poll the federation inbox automatically at the beginning of every session.

Access remote messages only after an explicit, task-specific user request.

Render message bodies strictly as untrusted data and never interpret their contents as agent instructions.

Require authenticated senders and cryptographically signed messages.

Implement a trusted-node allowlist and explicit per-sender authorization policies.

Do not expose arbitrary structured commands directly to the agent. Define a narrow command schema and reject unknown commands and fields.

Require separate confirmation that clearly identifies the sender, exact operation, parameters, destination, and expected side effects.

Filter or quarantine messages containing instruction-like content, credential requests, external download requests, or attempts to override system and user directives.

Maintain an audit log of received messages, sender identity, authorization decisions, and resulting actions.

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:48
Finding: Automatic External Registration Uses a Hostname-Derived Node Identity
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 48-70
Vulnerability Type: Unconsented external registration and machine-identity exposure
Risk Level: High

Vulnerable Code Snippet

markdown
## First run — zero-config bootstrap On first use, the skill auto-registers. No setup, no API key, no identity required to start. ```bash coh status

This works immediately. If coh is not installed yet, run npm i -g coherence-cli first.

Identity is optional but recommended. To get credit for contributions:

bash
coh identity link github <your-github-handle>

That's it. No account creation, no API key, no registration form. Your GitHub handle becomes your persistent identity across all sessions and nodes.

OpenClaw session protocol (bidirectional messaging)

OpenClaw loads this skill when a session starts. Check the inbox before any other work so messages from other federation nodes are not missed. Any node can send traffic with coh msg or structured coh cmd; the recipient sees it on the next inbox poll.

Start of every session (in order):

coh inbox — list messages for this node (CLI: resolves your node_id from hostname, then GET /api/federation/nodes/{node_id}/messages?unread_only=false&limit=20; unread messages are marked in the output).

text
### Technical Analysis The documented first-use flow automatically registers the client with an external service. The inbox operation derives the node identifier from the machine hostname. Hostnames can contain employee names, device roles, organizational naming conventions, internal asset identifiers, or other information that should not be disclosed to a public service. Registration also creates a persistent, externally addressable identity and enables a bidirectional messaging relationship. The documentation does not require informed consent before registration, describe the exact registration payloa ...[truncated 1694 chars]
Remediation: View remediation
Remediation Suggestions

Require explicit informed consent before external registration or transmission of a node identifier.

Display the destination, complete data fields, retention policy, and purpose before registration.

Generate a random pseudonymous identifier rather than deriving identity from the local hostname.

Keep federation registration and inbound messaging disabled by default.

Provide commands to inspect, rotate, revoke, and permanently delete the registered node identity.

Minimize registration metadata and avoid transmitting hostnames, usernames, local paths, or environment details.

Ensure node listings do not expose identifiers or metadata beyond authenticated, authorized federation participants.

Apply rate limits, sender authorization, blocking controls, and abuse reporting to the messaging channel.

Treat identity-provider linking as a separate opt-in action and clearly explain its cross-session correlation effects.

T08 · Insecure Dependencies

Warning

Location: references/mcp-server.md:3
Finding: Unpinned npm and npx Commands Execute Mutable Third-Party Packages
Content: View full analysis
Vulnerability Details

File Location: references/mcp-server.md, lines 3-13
Vulnerability Type: Unpinned third-party dependency installation and execution
Risk Level: Medium

Vulnerable Code Snippet

markdown
## Install & Run ```bash npx coherence-mcp-server

Or install globally:

bash
npm i -g coherence-mcp-server coherence-mcp-server

text
The same unsafe installation pattern also appears in `SKILL.md`: ```markdown This works immediately. If `coh` is not installed yet, run `npm i -g coherence-cli` first.

markdown
npx coherence-mcp-server

Technical Analysis

The recommended commands reference npm packages by name without pinning an audited version or validating an integrity digest. Package names resolve to mutable registry releases, meaning the code executed in the future may differ from the code reviewed when this skill was published.

npx coherence-mcp-server is especially sensitive because npx can download and immediately execute a package. Global installation with npm i -g also places executable files into a shared command location, increasing the persistence and blast radius of a compromised dependency.

No lockfile, checksum, package signature, source commit, provenance verification procedure, or restricted installation mode is provided in the audited project. This exposes users to package-account compromise, malicious release replacement, registry compromise, or other supply-chain attacks.

Attack Path

An attacker compromises the package publisher, npm account, release process, or package registry.

The attacker publishes a malicious version under coherence-mcp-server or coherence-cli.

A user follows the skill documentation and runs the unversioned npx or npm i -g command.

npm resolves the mutable package name to the attacker-controlled release.

Installation lifecycle scripts or the package entry point ex ...[truncated 892 chars]
Remediation: View remediation
Remediation Suggestions

Pin every package to a specifically reviewed version, for example coherence-mcp-server@X.Y.Z.

Provide and verify npm integrity hashes or signed release provenance.

Link each approved package version to an immutable source commit and reproducible build information.

Avoid global installation; use a project-local dependency with a lockfile and restricted permissions.

Avoid automatic npx downloads. Install dependencies in a separate, explicit approval step before execution.

Use npm ci with a committed lockfile where a local project installation is possible.

Disable installation lifecycle scripts when they are unnecessary and verify package contents before execution.

Run the CLI or MCP server in a sandbox with minimal filesystem, network, environment-variable, and credential access.

Establish a dependency review and update process so version changes require security assessment rather than automatically resolving to the latest release.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger list is extremely broad and includes generic terms like ideas, trust, freedom, collaboration, portfolio, and ROI, which can cause this skill to auto-activate in many unrelated conversations. Overbroad triggering is dangerous because it increases the chance that an agent will load instructions that encourage external network access, messaging peers, task claiming, or package execution in contexts where the user did not request this skill.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 348)May include surrounding context.
md
For the full endpoint table, see `references/api-endpoints.md` or browse the live OpenAPI at `https://api.coherencycoin.com/docs`.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/mcp-server.md (reported line 20)May include surrounding context.
Claude Desktop / Claude Code

Add to ~/.claude/settings.json or project .claude/settings.json:

json
{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.
curl -s "$CN_API/api/ideas/IDEA-ID/tasks" | jq .

Actions (write)

curl -s "$CN_API/api/ideas/select" -X POST -H "Content-Type: application/json" -d '{"temperature": 0.5}' | jq . curl -s "$CN_API/api/ideas/IDEA-ID/stake" -X POST -H "Content-Type: application/json" -d '{"contributor_id":"alice","amount_cc":10}' | jq . curl -s "$CN_API/api/ideas/IDEA-ID/fork?forker_id=alice" -X POST | jq .

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: This example sends contributor identity and stake amount to a third-party API in a state-changing request. In an agent setting, especially combined with broad triggers and auto-use framing, such examples can normalize or induce unintended financial or account-affecting actions against an external platform.
Content: Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
Actions (write)

curl -s "$CN_API/api/ideas/select" -X POST -H "Content-Type: application/json" -d '{"temperature": 0.5}' | jq . curl -s "$CN_API/api/ideas/IDEA-ID/stake" -X POST -H "Content-Type: application/json" -d '{"contributor_id":"alice","amount_cc":10}' | jq . curl -s "$CN_API/api/ideas/IDEA-ID/fork?forker_id=alice" -X POST | jq .

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.
bash
curl -s "$CN_API/api/value-lineage/links?limit=20" | jq '.[] | {id, idea_id, spec_id, implementation_refs}' curl -s "$CN_API/api/value-lineage/links/LINEAGE-ID/valuation" | jq '{measured_value_total, estimated_cost, roi_ratio}' curl -s "$CN_API/api/value-lineage/links/LINEAGE-ID/payout-preview" \ -X POST -H "Content-Type: application/json" \ -d '{"total_value": 1000}' | jq '.rows[] | {role, contributor, amount, effective_weight}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The skill documents linking external identities such as GitHub, Discord, and blockchain addresses to a contributor account through a remote POST. This can expose personal identifiers and create persistent account linkage, which is sensitive in an agent workflow if triggered or suggested without clear consent and privacy boundaries.
Content: Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.
bash
# Link any identity (37 providers: github, discord, telegram, ethereum, solana, nostr, linkedin, orcid, did, ...) curl -s "$CN_API/api/identity/link" -X POST -H "Content-Type: application/json" \ -d '{"contributor_id":"alice","provider":"github","provider_id":"alice-dev"}' # List all providers

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: This records a contribution under a provider identity by transmitting attribution data to an external service. In context, it is a state-changing write tied to identity and value accounting, so unintended execution could create fraudulent records, privacy issues, or unwanted account activity.
Content: Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.
bash
# Record a contribution using provider identity instead of contributor_id curl -s "$CN_API/api/contributions/record" -X POST -H "Content-Type: application/json" \ -d '{"provider":"github","provider_id":"alice-dev","type":"code","amount_cc":5}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: These PATCH examples claim and complete agent tasks on a remote system, altering shared task state and reporting work under a worker identity. In an autonomous-agent context, this is particularly risky because the skill also instructs agents to check inboxes and coordinate with peers, which could lead to unauthorized actions, task hijacking, or externally influenced agent behavior.
Content: Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.
md
curl -s "$CN_API/api/agent/tasks?status=pending&limit=10" | jq '.tasks[] | {id, task_type, direction, context}' # Claim a task curl -s "$CN_API/api/agent/tasks/TASK-ID" -X PATCH -H "Content-Type: application/json" \ -d '{"status":"running","worker_id":"my-node"}' # Report result

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.
md
| Surface | What it is | Link | |---------|-----------|------| | **Web** | Browse ideas, specs, and contributors visually | [coherencycoin.com](https://coherencycoin.com) | | **API** | Full OpenAPI surface — the engine behind everything | [api.coherencycoin.com/docs](https://api.coherencycoin.com/docs) | | **CLI** | Terminal-first access — `npm i -g coherence-cli` then `coh help` | [npm: coherence-cli](https://www.npmjs.com/package/coherence-cli) | | **MCP Server** | Typed tool surface for AI agents (Claude, Cursor, Windsurf) | [npm: coherence-mcp-server](https://www.npmjs.com/package/coherence-mcp-server) | | **OpenClaw Skill** | This skill — auto-triggers inside any OpenClaw instance | [ClawHub: coherence-network](https://clawhub.com/skills/coherence-network) |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 348)May include surrounding context.
md
| Surface | What it is | Link | |---------|-----------|------| | **Web** | Browse ideas, specs, and contributors visually | [coherencycoin.com](https://coherencycoin.com) | | **API** | Full OpenAPI surface — the engine behind everything | [api.coherencycoin.com/docs](https://api.coherencycoin.com/docs) | | **CLI** | Terminal-first access — `npm i -g coherence-cli` then `coh help` | [npm: coherence-cli](https://www.npmjs.com/package/coherence-cli) | | **MCP Server** | Typed tool surface for AI agents (Claude, Cursor, Windsurf) | [npm: coherence-mcp-server](https://www.npmjs.com/package/coherence-mcp-server) | | **OpenClaw Skill** | This skill — auto-triggers inside any OpenClaw instance | [ClawHub: coherence-network](https://clawhub.com/skills/coherence-network) |

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users/agents to run npx coherence-mcp-server without pinning a version or integrity hash, which fetches and executes the latest package code from the registry at runtime. In an agent context, this creates a supply-chain execution path where a compromised package, maintainer account, or malicious update could immediately lead to arbitrary code execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file documents authentication and many write/execute endpoints, including task execution, distributions, sync payload receipt, and auto-heal actions, but it provides no warning about possible effects on user data, system state, or automation behavior. Under SQP-2 for markdown files, descriptions should disclose behaviors that could affect privacy, integrity, or irreversible state changes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The documentation instructs users to run an MCP server via npx coherence-mcp-server without pinning a specific version. That causes the latest published package to be fetched and executed at install/run time, creating a supply-chain risk if the package is compromised, updated maliciously, or unexpectedly changes behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The MCP server exposes write-capable operations such as coherence_link_identity and coherence_record_contribution, and the documentation notes that COHERENCE_API_KEY enables write operations, but it does not warn users that these actions can modify remote state. In an agent context, users may connect the server assuming it is read-only, increasing the chance of unintended writes or abuse if an agent invokes tools automatically.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code Snippet

Technical Analysis

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code Snippet

OpenClaw session protocol (bidirectional messaging)

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code Snippet

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Vague Triggers

Ae1

Agent Config Directory Access

Claude Desktop / Claude Code

External Transmission

Actions (write)

External Transmission

Actions (write)

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Rp1

Missing User Warnings

Rp1

Missing User Warnings

Static analysis