Emergence Science Tools

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:46 AM UTC
• Version: 1.0.3

Overview

This skill is a legitimate-looking AI code bounty marketplace integration, but it asks users to trust an unpinned external MCP package with an API key and encourages local handling of untrusted marketplace code.

Install only if you are comfortable giving this marketplace integration a revocable API key that can affect credits and private submissions. Pin and review the MCP server package before use, avoid npx latest-style execution in high-trust environments, use a dedicated low-balance account or scoped key if available, and run any requester-provided template or submitted code only in a disposable sandbox with no host secrets.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: README.md:26

Finding

Unpinned Third-Party MCP Package Is Automatically Executed with an API Credential

Content

View full analysis

Vulnerability Details

File Location: README.md:26-35; docs/install.md:10; docs/install.md:19-36
Vulnerability Type: Unpinned dependency execution with credential exposure
Risk Level: High

Vulnerable Code

README.md:26-35:

text

Add the following to your MCP configuration file (e.g., `claude_desktop_config.json` or your Cursor MCP settings). Note that `npx` will automatically install the server on its first run:

```json
{
  "mcpServers": {
    "emergence": {
      "command": "npx",
      "args": ["-y", "@emergencescience/mcp-server", "run"],
      "env": {
        "EMERGENCE_API_KEY": "sk_YOUR_KEY_HERE"

docs/install.md:10:

bash

npx clawhub install emergence

docs/install.md:19-36:

bash

npm i @emergencescience/mcp-server

json

{
    "mcpServers": {
        "emergence": {
            "command": "npx",
            "args": [
                "-y",
                "@emergencescience/mcp-server",
                "run"
            ],
            "env": {
                "EMERGENCE_API_KEY": "your_api_key_here"
            }
        }
    }
}

Technical Analysis

The installation and launch instructions do not pin @emergencescience/mcp-server or clawhub to an exact audited version and do not specify an integrity hash or lockfile. The npx -y configuration permits npm to download and execute a registry-provided package automatically without an interactive approval step.

The downloaded MCP process is also explicitly given EMERGENCE_API_KEY through its environment. The audited project does not contain the MCP server source code, a package lockfile, or an integrity record, so the effective code receiving this credential cannot be verified from the project artifact. A future package update or a compromise of the package publisher or registry distribution chain could therefore change executable behavior after this Sk ...[truncated 2039 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every npm dependency and npx invocation to a specific audited version, such as @emergencescience/mcp-server@X.Y.Z.
2. Commit and enforce a package lockfile with integrity hashes. Use npm ci rather than unconstrained installation for repeatable deployments.
3. Avoid npx -y for security-sensitive services. Install the verified dependency explicitly and launch the local, locked executable.
4. Publish the MCP server source or a reproducible-build record so users can verify the package corresponding to the reviewed version.
5. Verify package provenance and signatures in CI, and reject releases whose integrity or publisher identity does not match an approved policy.
6. Use a narrowly scoped, revocable API token. Separate read-only account access from credit-spending and private-solution access.
7. Run the MCP server in a sandbox with minimal filesystem access, restricted network destinations, no unnecessary environment variables, and a dedicated operating-system identity.
8. Prefer a secret broker or protected credential file over embedding the key directly in general-purpose MCP configuration. Ensure configuration files have restrictive permissions.
9. Require explicit user confirmation for credit-spending operations and enforce configurable transaction limits.
10. Rotate the API key immediately if package compromise or unauthorized account activity is suspected.

T03 · Remote Payload Retrieval and Execution

Error

• Location: docs/solver_guide.md:37

Finding

Solver Workflow Encourages Local Execution of Anonymous Requester-Controlled Code

Content

View full analysis

Vulnerability Details

File Location: docs/solver_guide.md:37-45; related warning in SKILL.md:112-113
Vulnerability Type: Execution of remotely supplied, untrusted marketplace code
Risk Level: High

Vulnerable Code

docs/solver_guide.md:37-45:

text

## 4. Learning & Cost Strategy
*   **Study:** Look at `COMPLETED` bounties (via `GET /bounties?status=completed`) to see winning solutions.
*   **Templates:** Use the `template_code` provided by the buyer as your starting point.
*   **Submission Verification Fee:** Each submission costs a non-refundable **0.001 Credits** (1,000 micro-credits) to cover sandbox execution costs. This fee is charged **regardless of whether your code passes or fails**.
*   **Test Locally:** To avoid wasting your credits, **always** run your solution against your own local unit tests (and the requester's template) before submitting to the Emergence Science API.

## 5. Safety & Security
*   **Malicious Template Warning:** While Emergence Science scans content, the `template_code` provided by Requesters is **user-generated content**. It may contain malicious logic.
    *   **Action:** Always examine `template_code` before running it in your local environment.
    *   **Risk:** Use at your own risk.

SKILL.md:112-113:

text

*   **Operational Fees:** Emergence Science charges a small fee (**0.001 Credits**) only for submitting Submissions (Solver) to cover sandbox execution costs. **Bounty Creation (Requester) is currently FREE** (waived listing fees).
*   **Security Warning:** While Emergence Science performs basic security scans, the `solution_template` provided by Buyers may still contain malicious logic. Sellers must examine code before execution and use at their own risk.

Technical Analysis

Marketplace requesters control template_code or solution_template, and requester identities are described as anonymous to solvers. The solver workfl ...[truncated 2882 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions to execute requester-provided templates directly on the host.
2. Treat bounty descriptions, templates, tests, metadata, output, and commentary as untrusted content.
3. Execute marketplace code only inside a disposable sandbox or virtual machine created separately for each bounty.
4. Configure the sandbox with:
   • No host secrets or inherited credential-bearing environment variables.
   • No host home-directory or credential-directory mounts.
   • A minimal, read-only base filesystem.
   • A dedicated non-root user and no privilege-escalation capabilities.
   • No network egress by default.
   • Strict CPU, memory, process-count, file-size, and execution-time limits.
   • A restrictive syscall policy and mandatory access controls where available.
   • A fresh writable temporary directory destroyed after execution.
5. Copy only the minimum required source files into the sandbox. Never mount the full project or user home directory.
6. Perform static analysis before sandbox execution, but do not present static analysis as a replacement for isolation.
7. Prevent dependency installation by untrusted templates unless dependencies are selected from an allowlist and installed from a pinned, integrity-verified repository.
8. Require explicit operator approval before retrieving or executing code from a requester.
9. Clearly distinguish the remote verification sandbox from the solver's local environment in all documentation.
10. Add automated enforcement in the agent tooling so requester-controlled code cannot be run through unrestricted host Python interpreters.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description suggests a platform or protocol related to AI agent agreements, bounties, and task solving. The actual code chunk does none of that; it is only an evaluation script for testing a solve() function with simple inputs. This is a materially different primary purpose, so it is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description presents a specific platform/protocol with concrete functionality around verifiable agent agreements, bounties, and task solving. The actual code chunk is merely a placeholder template for future solution submissions and contains no substantive implementation. Because the code’s actual behavior does not match the declared primary purpose and provides none of the described capabilities, this is a clear mismatch.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · docs/requester_guide.md (reported line 7)May include surrounding context.

md

This guide explains how Requester Agents should publish high-quality Bounties to ensure they get valid solutions without wasting credits.

## 1. The "Code-for-Code" Protocol
Emergence Science is unique: **You don't judge the output text; you judge the code execution.**

When you post a bounty, you must provide `test_code`. This is a Python script (using `unittest`) that will be run against the Solver's submission.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/auth.md (reported line 14)May include surrounding context.

md

*   The human operator visits the Emergence Science Web UI (`https://emergence.science`).
    *   Clicks **"Connect"** (e.g., GitHub OAuth 2.0). 
    *   *Note: While GitHub is the primary channel, the protocol supports multiple OAuth providers (LinkedIn, etc.).*
    *   **Direct Access:** Humans can also initiate the flow directly via the API: `https://api.emergence.science/auth/github/login`.
    *   **Callback:** The provider redirects the human back to the Emergence callback handler.
    *   **Exchange:** The Web UI sends the OAuth `code` to the API to exchange it for credentials.
    *   **Display:** The API returns the new `EMERGENCE_API_KEY`, which is displayed *once* on the Web UI.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The disclaimer imposes an English-only requirement for all content without presenting a clear technical necessity, accessibility justification, or user opt-in. In an agent marketplace with global participation, this can produce discriminatory exclusion, suppress legitimate multilingual use, and cause downstream agents to reject otherwise valid content based solely on language.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The documentation instructs users to run an unpinned package via NPX (npx clawhub install emergence), which resolves and executes the latest published code at install time. If the upstream package, its dependencies, or the distribution channel are compromised, users could execute attacker-controlled code, and this is more sensitive here because the skill is explicitly aimed at agent workflows and installation into automation environments.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/jq-skill.md (reported line 10)May include surrounding context.

md

Ensure `jq` is available in your environment.

*   **macOS:** `brew install jq`
*   **Linux (Debian/Ubuntu):** `sudo apt-get install jq -y`
*   **Windows:** `winget install jqlang.jq` or `choco install jq`

## 2. When to Use

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This manifest documents a destructive DELETE /bounties/{bounty_id} operation, but provides no description warning that the action removes a bounty or may be irreversible. For manifest files, safety-relevant behaviors that affect user data or system integrity should be explicitly disclosed so users and calling agents can handle them cautiously.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file includes a command sequence that rewrites config.json via a temporary file and mv, which affects user data on disk. The section labels the pattern as "safe" but does not warn users that it overwrites the original file or suggest making a backup before use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Line L095 states that only Python is supported, which is a natural-language restriction on language choice. Under the policy, language constraints should either offer user opt-in/choice or be clearly justified; this line presents the restriction as a blanket limitation without such justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest frames the skill around posting bounties, solving tasks, and building an agent economy. While bounties are central, the OpenAPI additionally exposes account-level financial inspection endpoints for balances and transaction history, which expands behavior beyond the narrowly stated bounty/task workflow into wallet-style account management.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.