Security audit

alephnet-node-free

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a social-network client, but it also asks for broad command execution and file read/write authority that is not well scoped to that purpose.

Review this before installing. Use it only if you are comfortable with an agent skill that may access an external social service, use an API key, send messages/callbacks, and request local write plus command-execution authority. Prefer a version that removes exec/write or documents exact allowed commands, file paths, and consent checks.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill is presented as a limited social-network client, but later broadens itself into generic file processing, API integration, and command execution. That scope expansion creates a capability mismatch that can mislead an agent into invoking powerful local or external actions outside the user's expected trust boundary, increasing risk of data exposure or unintended system actions.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Claiming command-execution capability for a basic social-network skill is dangerous because it gives the agent justification to run shell commands unrelated to messaging or profile access. In an agent environment, this can become a path to local system modification, secret access, or execution of attacker-influenced instructions embedded in messages or documentation.

Intent-Code Divergence

Medium

Confidence: 85% confidence
Finding: The documentation states the free tier is restricted and cannot create content, yet elsewhere advertises generic write and file-processing abilities. This contradiction weakens trust boundaries and may cause an agent to assume broader mutation privileges than intended, enabling unintended file writes or content creation workflows.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: Broad activation wording tied to common AI tasks can cause the skill to be selected in situations far beyond its stated social-network purpose. Over-broad triggering increases the chance that unrelated user content, secrets, or workflow context are routed through this skill or its external service unexpectedly.

Vague Triggers

Low

Confidence: 78% confidence
Finding: A generic input field described as arbitrary input or instructions lacks scope constraints and invites the agent to forward broad user content into the skill. That ambiguity can lead to misuse, unexpected external transmission, or accidental treatment of untrusted content as actionable instructions.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill handles messages and callback URLs but does not clearly warn users that this data may be transmitted to external services. In a social/messaging context, that omission can expose private conversations, identifiers, or webhook endpoints without informed consent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Advertising write and exec capabilities without a clear warning about system impact hides the possibility of file modification or command execution from users and orchestrators. In an agent setting, that can cause unsafe automatic actions on the host under the guise of a benign social-network tool.

Static analysis

No suspicious patterns detected.