Alephnet Node Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.2

Overview

The skill is not clearly malicious, but it requests broad command, file, persistence, agent, and wallet authority without tight scoping or clear user confirmations.

Install only if you specifically need AlephNet node administration. Run it with narrow filesystem and command permissions, verify and pin any npm packages before installing, keep API keys out of broad agent environments, and require explicit confirmation for memory writes, team activation, coherence submissions, staking, or token transfers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:240

Finding

Unpinned Third-Party npm Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 240–241
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

| @aleph-ai/tinyaleph | npm 包 | 推荐 | `npm install @aleph-ai/tinyaleph`，完整语义计算 |
| @sschepis/resolang | npm 包 | 推荐 | `npm install @sschepis/resolang`，WASM 符号计算 |

Technical Analysis

The documented installation commands do not specify exact package versions, lockfile-resolved versions, or expected integrity hashes. Consequently, each installation resolves whatever package release and dependency graph the npm registry serves at that time.

npm packages may execute lifecycle scripts during installation. If either named package, one of its transitive dependencies, or the associated publisher account is compromised, following these instructions could execute attacker-controlled code with the permissions of the user running npm. The repository contains no implementation, package manifest, lockfile, vendored source, or integrity metadata through which the effective dependency code can be reviewed or reproducibly resolved.

This is a supply-chain exposure rather than evidence that either named package is currently malicious.

Attack Path

1. An attacker compromises a listed package, its publisher account, or a transitive dependency and publishes a malicious release.
2. A user or AI agent follows the documented unversioned npm install command.
3. npm resolves and downloads the malicious release or dependency.
4. Malicious package code or a lifecycle script executes during installation or subsequent package use.
5. The payload accesses resources available to the installer, potentially including local files, environment variables, and the API credentials described elsewhere in SKILL.md.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope may inc ...[truncated 571 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each reviewed package to an exact version rather than using an unconstrained installation command.
2. Add a package manifest and commit the corresponding lockfile so dependency resolution is reproducible.
3. Use npm ci against the reviewed lockfile in automated or production environments.
4. Record and verify package integrity metadata and npm registry provenance before installation.
5. Review direct and transitive dependency contents, maintainers, release history, and lifecycle scripts.
6. Use npm audit and complementary software-composition analysis during CI, while recognizing that automated advisories do not detect every supply-chain compromise.
7. Disable lifecycle scripts with --ignore-scripts where package functionality permits; otherwise, explicitly review every required install script.
8. Install dependencies as a least-privileged user in an isolated build environment without production credentials.
9. Do not expose API keys or sensitive configuration to dependency installation processes unless strictly necessary.
10. Establish a controlled upgrade process in which new package versions and lockfile changes are reviewed before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description says to use the skill broadly whenever AI model calls, dialogue, agent orchestration, or LLM applications are needed, which is far wider than the actual node-management scope. Overbroad routing criteria can cause the platform to invoke a powerful skill unnecessarily, exposing data to external services or enabling command execution in contexts where a narrower, safer skill should have been selected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description does not define crisp boundaries, prerequisites, or negative examples for when it should not be used. In an automated agent ecosystem, this ambiguity increases accidental invocation and privilege misuse, especially because the skill advertises system command execution, file writes, and third-party integrations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description mandates Chinese interaction without user opt-in. While not a direct exploit primitive, forced language can cause users or calling agents to misunderstand commands, confirmations, and side effects, increasing the chance of unsafe execution or missed warnings in a privileged operational skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The input definition uses generic content-review fields instead of parameters for concrete node-management actions. Ambiguous inputs in a skill with exec/write capabilities increase the chance that a calling agent will infer missing arguments, execute unintended operations, or apply the skill to unrelated tasks under false assumptions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented return schema is for a generic scoring/audit report and does not match the node-management behaviors described elsewhere in the skill. This mismatch can cause an agent or orchestrator to mis-handle outputs, route tasks incorrectly, or trust fabricated success states, which is a security concern when the skill also advertises exec/write/network capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The markdown advertises file handling, API integration, and command execution but does not present a clear user-facing warning about system or data impact before those capabilities are used. In a skill that can read, write, and exec, missing consent and impact disclosure materially increases the risk of unintended file modification, secret exposure, external data transmission, or harmful command execution.

Content

No source excerpt is available for this finding.