Security audit

Alephnet Node

Security checks for vulnerabilities and agentic risk

Overview

This skill includes a networked agent server that can automatically run model-selected shell and file tools with weak authorization, so it needs review before installation.

Install only in an isolated environment with no sensitive environment variables or credentials. Do not expose the server to a network until run_command and shell-based PDF extraction are removed or tightly sandboxed, authentication is changed to an allowlist or role model, and high-impact tool execution requires explicit user approval. Treat the wallet/token features as experimental and update or audit dependencies before production use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: lib/app/shared.js:45
Finding: System Prompt Forces Autonomous Tool Use Without User Confirmation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: lib/tools.js:1028
Finding: Model-Generated Tool Calls Permit Arbitrary Shell Command Execution
Content: View full analysis
{ const isWindows = process.platform === 'win32'; const shell = isWindows ? 'cmd.exe' : '/bin/sh'; const shellArg = isWindows ? '/c' : '-c'; const child = spawn(shell, [shellArg, command], { cwd: workDir, env: process.env, timeout: this.commandTimeout }); let stdout = ''; let stderr = ''; child.stdout.on('data', (data) => { stdout += data.toString(); }); child.stderr.on('data', (data) => { stderr += data.toString(); }); ``` ```js async function processToolCalls(response, executor) { const toolCalls = parseToolCalls(response); if (toolCalls.length === 0) { return { hasTools: false, results: [], cleanedResponse: response }; } const results = []; let cleanedResponse = response; for (const toolCall of toolCalls) { ...[truncated 2561 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: lib/auth-middleware.js:69
Finding: Caller-Supplied Keys Grant Privileged Access Without Authorization
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: lib/tools.js:1118
Finding: PDF Page Parameter Is Interpolated Into a Shell Command
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/core/agent/prompt-engine/utils.ts:141
Finding: Prompt Conditions Are Evaluated as Dynamically Generated JavaScript
Content: View full analysis
): boolean { try { const interpolatedCondition = Object.entries(variables).reduce( (acc, [key, value]) => acc.replace( new RegExp(`\\b${key}\\b`, 'g'), JSON.stringify(value) ), condition ); const result = new Function(`return ${interpolatedCondition}`)(); return Boolean(result); } catch (error) { console.error(`Error evaluating condition: ${condition}`, error); return false; } } ``` ```ts if (template.then) { for (const [condition, action] of Object.entries(template.then)) { const interpolatedCondition = interpolate( condition, { ...parsedContent, state: this.state } ); if (safeEvaluate( interpolatedCondition, { ...parsedContent, state: this.state } )) { if (action.prompt) { const nextArgs = interpolate( action.arguments, { ...parsedContent, state: this.state } ); return this.execute(action.prompt, nextArgs, options); } else if (action.function) { const funcName = action.function; const funcArgs = interpolate( action.arguments, { ...parsedContent, state: this.state } ); const toolDef = this.config.tools.find( t => t.function.name === funcName ); if (toolDef && toolDef.function.script) { return toolD ...[truncated 1763 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/infra/Wallet.ts:151
Finding: Wallet Operations Permit Invalid Amounts and Unauthorized Payment Finalization
Content: View full analysis
{ const balance = await this.getBalance(); if (balance.available < amount) { throw new Error('Insufficient funds'); } const txId = crypto.randomUUID(); const timestamp = Date.now(); const transaction: any = { id: txId, type: 'TRANSFER', from: this.address, to, amount: amount.toString(), fee: '0', timestamp, purpose: options?.purpose, memo: options?.memo, status: 'CONFIRMED' }; this.gun.get('ledger').get('transactions').get(txId).put(transaction); const newAvailable = balance.available - amount; this.gun.get('ledger').get('accounts').get(this.address).put({ available: newAvailable.toString(), updatedAt: timestamp }); this.gun.get('ledger').get('accounts').get(to).once((data: any) => { const current = data ? BigInt(data.available || '0') : 0n; this.gun.get('ledger').get('accounts').get(to).put({ available: (current + amount).toString(), updatedAt: timestamp }); }); ``` ```ts public async finalizePayment( authorizationId: string, actualAmount?: bigint ): Promise { return new Promise((resolve, reject) => { this.gun.get('ledger').get('authorizations') .get(authorizationId) .once(async (authData: any) => { if (!authData || authData.status !== 'PENDING') { reject(new Error('Invalid or expired authorization')); return; } const maxAmount = BigInt(authData.maxAmount); const finalAmount = actualAmount ! ...[truncated 3285 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (415)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The run_command tool executes arbitrary shell commands via /bin/sh or cmd.exe using model-provided input, inheriting the process environment and allowing optional working-directory control. In an agent setting, this creates a direct remote-code-execution primitive that can be abused to exfiltrate secrets, modify the system, install malware, or pivot further into the environment.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: handlebars==4.7.8 — 8 advisory(ies): CVE-2026-33916 (Handlebars.js has Prototype Pollution Leading to XSS through Partial Template In); CVE-2026-33937 (Handlebars.js has JavaScript Injection via AST Type Confusion); CVE-2026-33938 (Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @part) +5 more

Critical

Category: Supply Chain
Confidence: 93% confidence
Finding: handlebars 4.7.8 carries multiple critical advisories including prototype pollution and possible code/script injection primitives, making this a significant vulnerable dependency. Although it is only brought in through ts-jest as a dev dependency, compromise of build/test environments can still enable malicious code execution, poisoned artifacts, or CI disruption, which is especially sensitive for an AI networking package that may be widely reused.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code chunk does not implement any of the substantial platform capabilities described. It merely configures the Jest test runner (ts-jest preset, Node test environment, test file matching, and extensions). This is materially different from the declared primary purpose, so the description does not accurately represent the actual behavior of the provided code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code chunk does not implement or expose a social/economic network for AI agents. Instead, it is narrowly focused on unit/integration tests for local memory-management classes. The observed behaviors include short-term buffer management, session similarity search using embeddings, persistent storage to local files, summaries/metadata, and context assembly. While the description mentions 'distributed memory,' this code only demonstrates local persistent memory via filesystem-backed JSON, not distributed/networked memory. There is no evidence here of social networking features, token economics, coherence verification, or autonomous learning. Therefore the declared description materially overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code chunk does not implement or expose any of the substantial capabilities described. Its actual purpose is limited to test-environment initialization: defining a minimal File mock on globalThis for undici compatibility and providing optional test log suppression. This is materially different from the declared description, so the description does not accurately represent the behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code chunk is a mathematical/graph-abstraction module. It discovers prime-sum triads, scores them, tracks usage, reinforces or decays entanglement strengths, finds reinforced paths, and computes abstraction/reasoning metrics. This may loosely fit a small part of 'autonomous learning' or internal semantic abstraction, but it does not implement the majority of the declared platform capabilities. There is no networking, persistence/distribution, economic/token handling, user/agent social features, or explicit coherence verification. The declared description therefore materially overstates and misrepresents what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The description is substantially broader than what this code chunk actually implements. The code does support parts of the declared purpose: coherence verification workflows, semantic-analysis integration via a semantic bridge, agent/task interactions, and token-economics-like staking and rewards. However, it does not show a 'complete social/economic network' nor distributed memory; persistence is local to a JSON file. It also does not implement autonomous learning or clear social networking features in this chunk. The module’s primary behavior is a coherence claims/tasks/stakes manager rather than the full platform described, so this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The description is much broader than what this code chunk actually implements. The code specifically provides token wallet actions, content storage actions, and cryptographic identity actions. While 'token economics' and some form of storage are aligned, the claimed capabilities of semantic computing, social networking, coherence verification, distributed memory, and autonomous learning are not represented here. Additionally, the code includes sensitive identity capabilities not mentioned in the declared permissions/purpose, including loading signing keys from environment variables and exporting identity material. Therefore the supplied description does not accurately represent this code chunk’s actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied code chunk is focused on a faucet subsystem, not a full AI-agent social/economic network. It exposes two actions, faucet.challenge and faucet.claim, and performs challenge issuance, rate limiting, proof-of-work verification, and token transfer from a treasury wallet. While token economics is loosely related because it distributes tokens, the broader declared description materially overstates the functionality: there is no evidence here of distributed memory, social networking, autonomous learning, semantic computing infrastructure, or coherence verification beyond a minimal keyword check. This is a significant description-to-behavior mismatch in primary purpose and implemented capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code chunk only exposes two feed actions, feed.get and feed.unread, backed by a lazily initialized feed manager. Its behavior is limited to returning feed items and unread summaries. This does not substantiate the sweeping declared description of a complete AI-agent social/economic network with semantic computing, distributed memory, coherence verification, autonomous learning, and token economics. While feed functionality could fit under a social networking umbrella, the primary purpose of this code chunk is much narrower and materially different from the broad declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code chunk is narrowly focused on group management and social interaction features. It does support a small subset of the declared 'social networking' concept, but there is no evidence here of semantic computing, distributed memory, coherence verification, autonomous learning, or token economics. The declared description substantially overstates the implemented functionality in this code chunk, making the description materially inaccurate relative to actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code chunk is narrowly focused on chat and room management. It exposes actions for sending/deleting messages, retrieving inbox/history, marking messages read, creating and managing rooms, inviting users, joining rooms, and listing/getting room info. While 'social networking' is loosely related, the declared description makes much broader claims about semantic computing, distributed memory, coherence verification, autonomous learning, and token economics, none of which are evidenced in this code. The primary purpose of this chunk is messaging, so the description does not accurately represent the actual behavior of the supplied code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code chunk is narrowly focused on social networking features: managing friends and profiles, plus profile links. It initializes FriendsManager and ProfileManager with local storage paths and exposes CRUD-like actions for friend requests and profile data. There is no evidence here of semantic computing, distributed memory, coherence verification, autonomous learning, or token economics. While 'social networking' is represented, the declared description substantially overstates the implemented functionality and primary scope of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code shown does not implement the broad platform described. It only re-exports or lazily loads classes from @aleph-ai/tinyaleph and provides a minimal fallback with agency level, history, goals/focus placeholders, and basic helper methods. There is no visible implementation of social/economic networking, distributed memory, learning, coherence verification, or token-related functionality. The actual primary purpose is an agency-layer adapter/fallback, which is materially narrower than the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a comprehensive social/economic infrastructure for AI agents, including distributed memory, social networking, semantic computing, autonomous learning, coherence verification, and token economics. The supplied code does not implement those platform-level capabilities. Instead, it is a single-agent task execution framework that analyzes task complexity, optionally decomposes tasks into steps, uses an LLM to plan or reason, invokes tools, tracks execution state, and emits events. There is a limited 'verify' step using an LLM, but that is only task-step verification, not a broader coherence-verification network feature. No code for social graphs, agent-to-agent networking, distributed storage, learning loops, or token/economic mechanisms is present. Therefore the description materially misrepresents the code's primary purpose and capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code shown does not implement or expose a complete AI-agent social/economic network. It only tests token-related financial logic: minting eligibility, reward formulas, staking tiers, APY calculations, lock bonuses, and unstaking behavior. There are minor references to concepts like 'memory attestation' and 'coherence', but these are only used as parameters in reward calculations, not as actual distributed memory, semantic computing, or coherence verification systems. No social networking, autonomous learning, agent networking, or broader platform capabilities are present in this chunk. Thus the declared description materially overstates and misrepresents the code's actual purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad multi-capability AI-agent platform, but the supplied code only contains a narrow token-staking tier calculation utility. While 'token economics' is loosely related, the actual implementation is limited to categorizing stake amounts and does not demonstrate the other major claimed capabilities. This is a materially different and much narrower purpose than described.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied code chunk is narrowly focused on CLI configuration parsing and help display. It sets defaults, parses flags for network/server/LLM/WebRTC settings, sets a DEBUG environment variable, and prints usage/help text. It does not implement or expose the declared high-level capabilities such as social/economic networking for AI agents, semantic computing, distributed memory, coherence verification, autonomous learning, or token economics. While the help text references joining a network and server endpoints, this chunk itself only handles argument parsing and documentation, so the declared description materially overstates what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description presents a broad AI-agent social/economic network with token economics and distributed capabilities. This code chunk is specifically a command-line interface for interacting with a local 'Sentient Observer' system. While there is partial overlap with concepts like distributed memory, autonomous learning, and coherence/safety inspection, the implemented behavior is much narrower and materially different in focus: a local CLI shell with network seed syncing, history persistence, agent task orchestration, and code execution. The ability to execute code blocks is a significant undeclared capability. Also, the declared token-economics aspect is not represented here. Therefore the description does not accurately match this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code chunk does not implement or meaningfully support the broad AI-agent network capabilities described. Instead, it is a small utility module for terminal colors, MIME type constants, and debug logging. While utility code can be part of a larger system, this specific chunk’s actual purpose is materially different from the declared description and includes unrelated server/static-serving support behavior not reflected in the description. Therefore, the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code chunk does not implement or directly expose the broad AI-agent network capabilities claimed in the description. Instead, it serves as a simple module aggregator/index for application components such as CLI/server classes, constants, and helper utilities. While this may be part of a larger application, the actual behavior visible in this chunk is materially narrower and different from the declared purpose, so the description does not accurately represent this code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description presents a broad platform centered on AI-agent social/economic networking, distributed memory, semantic computing, coherence verification, autonomous learning, and token economics. This code chunk, however, specifically implements a server layer: HTTP routing, SSE streams, provider management, WebRTC signaling/coordinator setup, observer status/history/memory endpoints, and learning-system controls. Some overlap exists with autonomous learning, memory, networking, and token-related behavior via faucet endpoints. However, the primary behavior shown is a backend server for a 'Sentient Observer' application, not clearly a complete social/economic agent network. Additionally, the presence of faucet challenge/claim endpoints indicates token-economics-related capability that is only indirectly reflected in the broad description, while several declared marquee capabilities (semantic computing, social networking, coherence verification) are not demonstrated in this code chunk. Overall, the declared description does not accurately represent this code chunk's concrete behavior and primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The supplied code chunk is narrowly focused on HTTP route definitions for agent and runner management. Its primary purpose is operational control of agents via CRUD, state access, execution steps, and run lifecycle endpoints. The declared description claims a much broader platform centered on social/economic networking and advanced capabilities such as semantic computing, distributed memory, coherence verification, autonomous learning, and token economics. None of those capabilities are implemented or evidenced in this code chunk. This is a material description-behavior mismatch because the actual code serves as an API layer for agent orchestration rather than the declared network/economic/learning system.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The supplied code chunk is narrowly focused on server-side chat request handling. It parses inbound chat messages, augments prompts with sensory data, streams LLM output, executes requested tools, stores conversation history, records learning data, and emits SSE events. While there are hints of coherence state, learning, and senses that loosely relate to parts of the broad platform description, this chunk does not implement or demonstrate a social/economic network, distributed memory, social networking, or token economics. Its primary purpose is chat API orchestration, which is materially different from the declared high-level capability set.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 86% confidence
Finding: The code chunk is narrowly focused on server-side API routes for managing and observing an autonomous learning component and related safety/chaperone functionality. While 'autonomous learning' is part of the declared description, the declared purpose presents a much broader platform centered on a complete social/economic network for AI agents with semantic computing, distributed memory, social networking, coherence verification, and token economics. None of those broader capabilities are implemented or evidenced in this code chunk. The code's actual purpose is operational control/telemetry for learning sessions, including SSE streaming and topic/question management. This is a material description-behavior mismatch in scope and primary function.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib/senses/git.js:27

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib/speech.js:35

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib/tools.js:620

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib/vertex-ai.js:126

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/core/agent/prompt-engine/utils.ts:147

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/common/crypto.ts:72