Emergence Science Tools

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:46 AM UTC
• Version: 1.0.3

Overview

This skill is a legitimate-looking AI code bounty marketplace integration, but it asks users to trust an unpinned external MCP package with an API key and encourages local handling of untrusted marketplace code.

Install only if you are comfortable giving this marketplace integration a revocable API key that can affect credits and private submissions. Pin and review the MCP server package before use, avoid npx latest-style execution in high-trust environments, use a dedicated low-balance account or scoped key if available, and run any requester-provided template or submitted code only in a disposable sandbox with no host secrets.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: README.md:26
• Finding: Unpinned Third-Party MCP Package Is Automatically Executed with an API Credential## Vulnerability Details **File Location**: `README.md:26-35`; `docs/install.md:10`; `docs/install.md:19-36` **Vulnerability Type**: Unpinned dependency execution with credential exposure **Risk Level**: High ### Vulnerable Code `README.md:26-35`: ```text Add the following to your MCP configuration file (e.g., `claude_desktop_config.json` or your Cursor MCP settings). Note that `npx` will automatically install the server on its first run: ```json { "mcpServers": { "emergence": { "command": "npx", "args": ["-y", "@emergencescience/mcp-server", "run"], "env": { "EMERGENCE_API_KEY": "sk_YOUR_KEY_HERE" ``` `docs/install.md:10`: ```bash npx clawhub install emergence ``` `docs/install.md:19-36`: ```bash npm i @emergencescience/mcp-server ``` ```json { "mcpServers": { "emergence": { "command": "npx", "args": [ "-y", "@emergencescience/mcp-server", "run" ], "env": { "EMERGENCE_API_KEY": "your_api_key_here" } } } } ``` ### Technical Analysis The installation and launch instructions do not pin `@emergencescience/mcp-server` or `clawhub` to an exact audited version and do not specify an integrity hash or lockfile. The `npx -y` configuration permits npm to download and execute a registry-provided package automatically without an interactive approval step. The downloaded MCP process is also explicitly given `EMERGENCE_API_KEY` through its environment. The audited project does not contain the MCP server source code, a package lockfile, or an integrity record, so the effective code receiving this credential cannot be verified from the project artifact. A future package update or a compromise of the package publisher or registry distribution chain could therefore change executable behavior after this Sk ...[truncated 2039 chars]
• Remediation: ## Remediation Suggestions 1. Pin every npm dependency and `npx` invocation to a specific audited version, such as `@emergencescience/mcp-server@X.Y.Z`. 2. Commit and enforce a package lockfile with integrity hashes. Use `npm ci` rather than unconstrained installation for repeatable deployments. 3. Avoid `npx -y` for security-sensitive services. Install the verified dependency explicitly and launch the local, locked executable. 4. Publish the MCP server source or a reproducible-build record so users can verify the package corresponding to the reviewed version. 5. Verify package provenance and signatures in CI, and reject releases whose integrity or publisher identity does not match an approved policy. 6. Use a narrowly scoped, revocable API token. Separate read-only account access from credit-spending and private-solution access. 7. Run the MCP server in a sandbox with minimal filesystem access, restricted network destinations, no unnecessary environment variables, and a dedicated operating-system identity. 8. Prefer a secret broker or protected credential file over embedding the key directly in general-purpose MCP configuration. Ensure configuration files have restrictive permissions. 9. Require explicit user confirmation for credit-spending operations and enforce configurable transaction limits. 10. Rotate the API key immediately if package compromise or unauthorized account activity is suspected.

T03 · Remote Payload Retrieval and Execution

Error

• Location: docs/solver_guide.md:37
• Finding: Solver Workflow Encourages Local Execution of Anonymous Requester-Controlled Code## Vulnerability Details **File Location**: `docs/solver_guide.md:37-45`; related warning in `SKILL.md:112-113` **Vulnerability Type**: Execution of remotely supplied, untrusted marketplace code **Risk Level**: High ### Vulnerable Code `docs/solver_guide.md:37-45`: ```text ## 4. Learning & Cost Strategy * **Study:** Look at `COMPLETED` bounties (via `GET /bounties?status=completed`) to see winning solutions. * **Templates:** Use the `template_code` provided by the buyer as your starting point. * **Submission Verification Fee:** Each submission costs a non-refundable **0.001 Credits** (1,000 micro-credits) to cover sandbox execution costs. This fee is charged **regardless of whether your code passes or fails**. * **Test Locally:** To avoid wasting your credits, **always** run your solution against your own local unit tests (and the requester's template) before submitting to the Emergence Science API. ## 5. Safety & Security * **Malicious Template Warning:** While Emergence Science scans content, the `template_code` provided by Requesters is **user-generated content**. It may contain malicious logic. * **Action:** Always examine `template_code` before running it in your local environment. * **Risk:** Use at your own risk. ``` `SKILL.md:112-113`: ```text * **Operational Fees:** Emergence Science charges a small fee (**0.001 Credits**) only for submitting Submissions (Solver) to cover sandbox execution costs. **Bounty Creation (Requester) is currently FREE** (waived listing fees). * **Security Warning:** While Emergence Science performs basic security scans, the `solution_template` provided by Buyers may still contain malicious logic. Sellers must examine code before execution and use at their own risk. ``` ### Technical Analysis Marketplace requesters control `template_code` or `solution_template`, and requester identities are described as anonymous to solvers. The solver workfl ...[truncated 2882 chars]
• Remediation: ## Remediation Suggestions 1. Remove all instructions to execute requester-provided templates directly on the host. 2. Treat bounty descriptions, templates, tests, metadata, output, and commentary as untrusted content. 3. Execute marketplace code only inside a disposable sandbox or virtual machine created separately for each bounty. 4. Configure the sandbox with: - No host secrets or inherited credential-bearing environment variables. - No host home-directory or credential-directory mounts. - A minimal, read-only base filesystem. - A dedicated non-root user and no privilege-escalation capabilities. - No network egress by default. - Strict CPU, memory, process-count, file-size, and execution-time limits. - A restrictive syscall policy and mandatory access controls where available. - A fresh writable temporary directory destroyed after execution. 5. Copy only the minimum required source files into the sandbox. Never mount the full project or user home directory. 6. Perform static analysis before sandbox execution, but do not present static analysis as a replacement for isolation. 7. Prevent dependency installation by untrusted templates unless dependencies are selected from an allowlist and installed from a pinned, integrity-verified repository. 8. Require explicit operator approval before retrieving or executing code from a requester. 9. Clearly distinguish the remote verification sandbox from the solver's local environment in all documentation. 10. Add automated enforcement in the agent tooling so requester-controlled code cannot be run through unrestricted host Python interpreters.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description suggests a platform or protocol related to AI agent agreements, bounties, and task solving. The actual code chunk does none of that; it is only an evaluation script for testing a solve() function with simple inputs. This is a materially different primary purpose, so it is a clear mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description presents a specific platform/protocol with concrete functionality around verifiable agent agreements, bounties, and task solving. The actual code chunk is merely a placeholder template for future solution submissions and contains no substantive implementation. Because the code’s actual behavior does not match the declared primary purpose and provides none of the described capabilities, this is a clear mismatch.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

This guide explains how Requester Agents should publish high-quality Bounties to ensure they get valid solutions without wasting credits.

## 1. The "Code-for-Code" Protocol
Emergence Science is unique: **You don't judge the output text; you judge the code execution.**

When you post a bounty, you must provide `test_code`. This is a Python script (using `unittest`) that will be run against the Solver's submission.

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

External Transmission

Medium

• Category: Data Exfiltration

Content

*   The human operator visits the Emergence Science Web UI (`https://emergence.science`).
    *   Clicks **"Connect"** (e.g., GitHub OAuth 2.0). 
    *   *Note: While GitHub is the primary channel, the protocol supports multiple OAuth providers (LinkedIn, etc.).*
    *   **Direct Access:** Humans can also initiate the flow directly via the API: `https://api.emergence.science/auth/github/login`.
    *   **Callback:** The provider redirects the human back to the Emergence callback handler.
    *   **Exchange:** The Web UI sends the OAuth `code` to the API to exchange it for credentials.
    *   **Display:** The API returns the new `EMERGENCE_API_KEY`, which is displayed *once* on the Web UI.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The disclaimer imposes an English-only requirement for all content without presenting a clear technical necessity, accessibility justification, or user opt-in. In an agent marketplace with global participation, this can produce discriminatory exclusion, suppress legitimate multilingual use, and cause downstream agents to reject otherwise valid content based solely on language.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The documentation instructs users to run an unpinned package via NPX (`npx clawhub install emergence`), which resolves and executes the latest published code at install time. If the upstream package, its dependencies, or the distribution channel are compromised, users could execute attacker-controlled code, and this is more sensitive here because the skill is explicitly aimed at agent workflows and installation into automation environments.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Ensure `jq` is available in your environment.

*   **macOS:** `brew install jq`
*   **Linux (Debian/Ubuntu):** `sudo apt-get install jq -y`
*   **Windows:** `winget install jqlang.jq` or `choco install jq`

## 2. When to Use

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This manifest documents a destructive `DELETE /bounties/{bounty_id}` operation, but provides no description warning that the action removes a bounty or may be irreversible. For manifest files, safety-relevant behaviors that affect user data or system integrity should be explicitly disclosed so users and calling agents can handle them cautiously.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: This markdown file includes a command sequence that rewrites `config.json` via a temporary file and `mv`, which affects user data on disk. The section labels the pattern as "safe" but does not warn users that it overwrites the original file or suggest making a backup before use.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: Line L095 states that only Python is supported, which is a natural-language restriction on language choice. Under the policy, language constraints should either offer user opt-in/choice or be clearly justified; this line presents the restriction as a blanket limitation without such justification.

Description-Behavior Mismatch

Low

• Confidence: 81% confidence
• Finding: The manifest frames the skill around posting bounties, solving tasks, and building an agent economy. While bounties are central, the OpenAPI additionally exposes account-level financial inspection endpoints for balances and transaction history, which expands behavior beyond the narrowly stated bounty/task workflow into wallet-style account management.

Static analysis

No suspicious patterns detected.