Alephnet Node Manager Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.0

Overview

This skill is mostly coherent, but it combines command execution, persistent memory/configuration, and external node messaging with broad trigger language and limited consent guidance.

Review this skill before installing if you do not want an agent to use shell commands for node-network operations. Only use it with explicit prompts for memory storage, recall, friend management, messaging, or node status; avoid sending sensitive content to memory or other nodes; and pin or independently review optional npm packages before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:259

Finding

Unpinned Third-Party npm Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 259–260
Vulnerability Type: Supply-chain exposure through unpinned third-party packages
Risk Level: Medium

Vulnerable Code Snippet:

markdown

| @aleph-ai/tinyaleph | npm package | Optional | `npm install @aleph-ai/tinyaleph`, enhances semantic computing |
| @sschepis/resolang | npm package | Optional | `npm install @sschepis/resolang`, WASM symbolic computing |

Technical Analysis

The Skill recommends installing two third-party npm packages without specifying exact versions, integrity hashes, lockfile enforcement, or package provenance verification. Consequently, each installation resolves the package version and content available from the configured npm registry at installation time rather than a fixed, audited artifact.

npm packages may execute lifecycle scripts during installation. If either package, its maintainer account, its transitive dependencies, or the configured package registry is compromised, malicious installation code could run with the privileges of the user operating the Agent. The reviewed project does not include the package source, a lockfile, integrity metadata, or other controls that would allow the effective dependency payload to be verified.

This finding establishes unsafe dependency installation guidance, not that either named package is currently malicious.

Attack Path

1. A user or Agent follows the documented instructions to enable an optional semantic-computing feature.
2. The Agent executes npm install @aleph-ai/tinyaleph or npm install @sschepis/resolang.
3. npm resolves mutable package and transitive-dependency content from the configured registry.
4. An attacker who has compromised a package release, maintainer account, dependency, or registry supplies malicious content.
5. npm installs the content and may execute its lifecycle scripts.
6. The malicious code runs locally under the privileges and ...[truncated 612 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to an exact, reviewed version rather than installing the latest matching registry release.
2. Maintain and enforce a lockfile containing dependency versions and integrity metadata.
3. Use npm ci in controlled deployments so installation fails when dependency state differs from the reviewed lockfile.
4. Verify package ownership, provenance, signatures where available, and registry integrity before recommending installation.
5. Review all transitive dependencies and npm lifecycle scripts before approval.
6. Use npm ci --ignore-scripts when lifecycle scripts are unnecessary. If scripts are required, document and review each required script explicitly.
7. Run installation and package functionality in a least-privileged, isolated environment with limited filesystem, credential, and network access.
8. Document the trusted registry and reject unexpected registry overrides or similarly named packages.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises memory storage, recall, config modification, export/save operations, and messaging without clear warnings about persistence, privacy, external transmission, or system-side effects. In context, this is more dangerous because the skill also supports exec and social-network interactions, so a user may unknowingly cause sensitive data to be stored locally, exported, or sent to other nodes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is broad enough to cause the skill to be invoked for generic AI-model, dialogue, orchestration, or LLM-related tasks, even when the user did not specifically intend to use this node-management capability. Because the skill has exec access and includes network, messaging, memory, and configuration functions, unintended invocation can lead to unnecessary command execution, data handling, or external communication beyond user expectations.

Content

No source excerpt is available for this finding.