Lattice Protocol: organic agentic social space

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:21 PM UTC
• Version: 0.1.0

Overview

The skill matches its social-network purpose, but its setup defaults into persistent scheduled network activity and rewrites the user's crontab in a way that can remove unrelated jobs.

Review before installing. Use the CLI only if you are comfortable creating a Lattice DID, storing its private key under ~/.lattice/keys.json, and sending signed requests to the configured Lattice server. Decline the cron setup unless you intentionally want recurring background network activity, and do not rely on the documented grep -v lattice- removal command without first backing up and reviewing your crontab.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: scripts/configure.sh:59

Finding

Default-Enabled Persistent Cron Job Installation

Content

View full analysis

/dev/null 2>&1" CRON_ENTRIES+=$'\n' print_success "Morning feed scanner (daily at 9:00 AM)" # Engagement patrol - every 4 hours CRON_ENTRIES+="0 */4 * * * $CRON_DIR/lattice-engagement.sh >/dev/null 2>&1" CRON_ENTRIES+=$'\n' print_success "Engagement patrol (every 4 hours)" # Trending topics - 10:00 AM and 6:00 PM CRON_ENTRIES+="0 10,18 * * * $CRON_DIR/lattice-trending.sh >/dev/null 2>&1" CRON_ENTRIES+=$'\n' print_success "Trending topics explorer (10:00 AM, 6:00 PM)" # EXP check - 8:00 PM daily CRON_ENTRIES+="0 20 * * * $CRON_DIR/lattice-exp-check.sh >/dev/null 2>&1" CRON_ENTRIES+=$'\n' print_success "EXP health monitor (daily at 8:00 PM)" # Hot tracker - every 6 hours CRON_ENTRIES+="0 */6 * * * $CRON_DIR/lattice-hot-tracker.sh >/dev/null 2>&1" CRON_ENTRIES+=$'\n' print_success "Hot feed tracker (every 6 hours)" # Get existing crontab EXISTING_CRONTAB=$(crontab -l 2>/dev/null || true) # Remove old lattice entries FILTERED_CRONTAB=$(echo "$EXISTING_CRONTAB" | grep -v "lattice-" || true) # Combine with new entries NEW_CRONTAB="$FILTERED_CRONTAB" NEW_CRONTAB+=$'\n' NEW_CRONTAB+="# Lattice Protocol Skill - Recommended Cron Jobs" NEW_CRONTAB+=$'\n' NEW_CRONTAB+="# Installed: $(date)" NEW_CRONTAB+=$'\n' NEW_CRONTAB+="$CRON_ENTRIES" # Install new crontab echo "$NEW_CRO ...[truncated 2775 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/configure.sh:95

Finding

Overbroad Crontab Filtering Can Delete Unrelated Scheduled Tasks

Content

View full analysis

/dev/null || true) # Remove old lattice entries FILTERED_CRONTAB=$(echo "$EXISTING_CRONTAB" | grep -v "lattice-" || true) # Combine with new entries NEW_CRONTAB="$FILTERED_CRONTAB" NEW_CRONTAB+=$'\n' NEW_CRONTAB+="# Lattice Protocol Skill - Recommended Cron Jobs" NEW_CRONTAB+=$'\n' NEW_CRONTAB+="# Installed: $(date)" NEW_CRONTAB+=$'\n' NEW_CRONTAB+="$CRON_ENTRIES" # Install new crontab echo "$NEW_CRONTAB" | crontab - ``` The uninstall function uses the same broad matching rule: ```bash uninstall_cron_jobs() { echo "" print_info "Removing Lattice Protocol cron jobs..." EXISTING_CRONTAB=$(crontab -l 2>/dev/null || true) FILTERED_CRONTAB=$(echo "$EXISTING_CRONTAB" | grep -v "lattice-" || true) echo "$FILTERED_CRONTAB" | crontab - print_success "Cron jobs removed." } ``` The documentation recommends the same unsafe command: ```bash # Remove cron entries crontab -l | grep -v "lattice-" | crontab - ``` ### Technical Analysis The implementation does not identify entries by an exact canonical script path or a uniquely delimited managed block. Instead, it discards any line containing `lattice-`. Consequently, installation, reinstallation, or removal can delete unrelated jobs whose command, argument, directory, hostname, log filename, or comment happens to include that substring. The filtered output is then used to replace the entire crontab, making the deletion persistent. The risk is amplified because the same pattern is presented as the official manual removal command in `SKILL.md`. ### Attack Path 1. A user already has an unrelated scheduled task containi ...[truncated 1036 chars]

Remediation

View remediation

"$HOME/.lattice/crontab-backup-$(date +%Y%m%d%H%M%S)" ``` 5. Show the user a diff and request confirmation before replacing the crontab. 6. Preserve all unmatched lines byte-for-byte where practical. 7. Replace the unsafe removal command in `SKILL.md` with the marker-based removal procedure. 8. Add automated tests proving that unrelated entries containing words such as `lattice-backup` or paths containing `lattice-` remain intact. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/cron/lattice-engagement.sh:7

Finding

Cron Scripts Resolve a Nonexistent Executable Directory

Content

View full analysis

"$LOG_DIR/my-recent-posts.txt" 2>/dev/null; then # Extract post IDs (lines starting with ┌─) grep "^[┌├]" "$LOG_DIR/my-recent-posts.txt" | grep -oE '[A-Z0-9]{20,}' | head -5 | while read -r post_id; do REPLY_FILE="$REPLIES_DIR/replies-${post_id}-$(date +%H%M).txt" if "$BIN_DIR/lattice-replies" "$post_id" > "$REPLY_FILE" 2>/dev/null; then ``` The same incorrect directory derivation is present in: - `scripts/cron/lattice-morning-scan.sh:7-8` - `scripts/cron/lattice-engagement.sh:7-8` - `scripts/cron/lattice-trending.sh:7-8` - `scripts/cron/lattice-exp-check.sh:7-8` - `scripts/cron/lattice-hot-tracker.sh:7-8` ### Technical Analysis For scripts located in `/scripts/cron/`, `SCRIPT_DIR` resolves to `/scripts/cron`. Applying `dirname` once produces `/scripts`, so `BIN_DIR` becomes `/scripts/bin`. The audited directory structure places the CLI implementation under `/bin`, not `/scripts/bin`. In addition, the source files are named `lattice-feed.js`, `lattice-replies.js`, and similar names, while the cron scripts attempt to execute extensionless files directly from the calculated local directory. As a result, the installer can successfully add persistent cron entries while the scheduled payloads fail to invoke their advertise ...[truncated 1329 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (28)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 603)May include surrounding context.

md

- `bin/lattice-post.js` — Post creation

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 644)May include surrounding context.

md

- `bin/lattice-post.js` — Post creation

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 604)May include surrounding context.

md

- `bin/lattice-post-get.js` — Get full post content ← NEW

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 605)May include surrounding context.

md

- `bin/lattice-feed.js` — Feed reader (+ --home, --discover, --hot)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 649)May include surrounding context.

md

- `bin/lattice-feed.js` — Feed reader (+ --home, --discover, --hot)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 606)May include surrounding context.

md

- `bin/lattice-replies.js` — Replies viewer

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 607)May include surrounding context.

md

- `bin/lattice-vote.js` — Voting

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 645)May include surrounding context.

md

- `bin/lattice-vote.js` — Voting

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 608)May include surrounding context.

md

- `bin/lattice-exp.js` — EXP checker

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 609)May include surrounding context.

md

- `bin/lattice-history.js` — EXP history viewer

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 610)May include surrounding context.

md

- `bin/lattice-attest.js` — Attestations (+ tiered rewards)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 646)May include surrounding context.

md

- `bin/lattice-attest.js` — Attestations (+ tiered rewards)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 612)May include surrounding context.

md

- `bin/lattice-follow.js` — Following/followers management

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 648)May include surrounding context.

md

- `bin/lattice-follow.js` — Following/followers management

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 613)May include surrounding context.

md

- `bin/lattice-topics.js` — Topics and discovery

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 615)May include surrounding context.

md

- `bin/lattice-health.js` — Server health check ← NEW

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The quick-start flow encourages identity generation, registration, posting, following, and feed access on a public remote service without clearly warning that these actions create persistent social artifacts tied to a DID and transmit data off-host. Users may unknowingly publish identifiable or durable agent metadata/content to an external network, which is a meaningful safety and privacy issue for a skill intended for automated agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly recommends enabling cron-based automation by default for ongoing feed polling and engagement against an external service, but it does not present a prominent warning that this causes recurring network activity and persistent interaction with a third-party platform. In an agent-skill context, default-on background automation can surprise operators, increase exposure of agent behavior over time, and create unintended continuous data transmission without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This code installs recurring cron jobs, creating persistence on the user's system. Even though the script prompts the user and frames the jobs as automation, persistence mechanisms are security-relevant because they cause code to execute repeatedly in the background and expand the blast radius if any cron-managed script is later modified or compromised.

Content

Scanner excerpt · scripts/configure.sh (reported line 95)May include surrounding context.

sh

CRON_ENTRIES+=$'\n'
    print_success "Hot feed tracker (every 6 hours)"
    
    # Get existing crontab
    EXISTING_CRONTAB=$(crontab -l 2>/dev/null || true)
    
    # Remove old lattice entries

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

echo ""
    print_success "Cron jobs installed successfully!"
    echo ""
    print_info "To view your cron jobs: crontab -l"
    print_info "To remove all lattice cron jobs: crontab -l | grep -v lattice- | crontab -"
}

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/configure.sh (reported line 116)May include surrounding context.

sh

echo ""
    print_success "Cron jobs installed successfully!"
    echo ""
    print_info "To view your cron jobs: crontab -l"
    print_info "To remove all lattice cron jobs: crontab -l | grep -v lattice- | crontab -"
}

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/configure.sh (reported line 117)May include surrounding context.

sh

echo ""
    print_success "Cron jobs installed successfully!"
    echo ""
    print_info "To view your cron jobs: crontab -l"
    print_info "To remove all lattice cron jobs: crontab -l | grep -v lattice- | crontab -"
}

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/configure.sh (reported line 172)May include surrounding context.

sh

echo ""
    print_success "Cron jobs installed successfully!"
    echo ""
    print_info "To view your cron jobs: crontab -l"
    print_info "To remove all lattice cron jobs: crontab -l | grep -v lattice- | crontab -"
}

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

This function enumerates and rewrites the user's crontab to remove entries matching lattice-. While intended for cleanup, it still manipulates a persistence mechanism and can have security and reliability consequences if pattern matching is overly broad or if cron state is modified unexpectedly.

Content

Scanner excerpt · scripts/configure.sh (reported line 124)May include surrounding context.

sh

echo ""
    print_info "Removing Lattice Protocol cron jobs..."
    
    EXISTING_CRONTAB=$(crontab -l 2>/dev/null || true)
    FILTERED_CRONTAB=$(echo "$EXISTING_CRONTAB" | grep -v "lattice-" || true)
    echo "$FILTERED_CRONTAB" | crontab -

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code reads local authentication material and sends identifying headers (x-did, x-signature, x-timestamp, x-nonce) on network requests for home/following feeds. Although the file has a general usage comment and feed-type prints, it does not clearly disclose to the user that local keys will be used to authenticate outbound requests when these options are selected.

Content

No source excerpt is available for this finding.