Hyperspace

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:57 PM UTC
• Version: 1.1.0

Overview

This skill is not proven malicious, but it should be reviewed carefully because its installer runs unverified remote code and immediately starts a persistent P2P compute node.

Install only if you intentionally want this machine to run a persistent Hyperspace network node. Before running the installer, prefer a pinned release with checksum or signature verification, review what service will be installed, confirm how to stop and remove it, and understand what hardware capabilities, metrics, prompts, and compute resources may be exposed through network participation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:13

Finding

Unverified Remote Script Is Executed Directly by Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–19 and 120–123
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

yaml

"install":
  [
    {
      "id": "hyperspace-cli",
      "kind": "bash",
      "command": "curl -fsSL https://agents.hyper.space/cli | bash",
      "bins": ["hyperspace"],
      "label": "Install Hyperspace Network Node",
    },
  ],

The same unsafe installation mechanism is repeated in the user-facing instructions:

bash

curl -fsSL https://agents.hyper.space/cli | bash

Technical Analysis

The Skill downloads a mutable response from https://agents.hyper.space/cli and pipes it directly into Bash. The payload is executed before the user or Agent can inspect it. No fixed release version, expected checksum, cryptographic signature, or immutable artifact URL is specified.

Although SKILL.md links to a public GitHub installation script, the executed URL is a separate endpoint. The reviewed project provides no mechanism proving that the endpoint serves the same script as the linked GitHub source. HTTPS protects the connection in transit but does not protect against compromise of the server, DNS or hosting account, deployment pipeline, or upstream release infrastructure.

The remote response receives all permissions available to the invoking process. Consequently, its effective behavior can change after this Skill has been reviewed without any modification to the local Skill package.

Attack Path

1. An attacker compromises the remote installer endpoint, its hosting infrastructure, or its deployment credentials.
2. The attacker replaces the expected response with a malicious shell script.
3. A user or Agent invokes the documented installation command.
4. curl retrieves the attacker-controlled response.
5. The pipe passes the response directly to Bash without inspection or integrity validati ...[truncated 932 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all curl | bash installation instructions and automated installation metadata.
2. Publish versioned artifacts through an official release mechanism and use an immutable version URL.
3. Download the artifact to a local file rather than executing a network stream.
4. Publish an expected SHA-256 or stronger digest through an independently protected channel and verify it before execution.
5. Cryptographically sign releases and verify the signature against a documented, pinned publisher key.
6. Display the resolved version, source URL, checksum, requested changes, and destination paths before asking for explicit installation consent.
7. Execute installation with the least-privileged account possible and avoid recommending elevated privileges unless a specific operation requires them.
8. Keep the installer source in the reviewed repository and ensure the distributed artifact is reproducibly tied to that source.
9. Fail closed if signature or checksum validation cannot be completed.

T06 · System Persistence

Error

• Location: SKILL.md:120

Finding

Installation Immediately Establishes a Persistent Network Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 120–125 and 198–201
Vulnerability Type: System persistence
Risk Level: High

Vulnerable Code

markdown

## Installation

```bash
curl -fsSL https://agents.hyper.space/cli | bash

This installs the CLI + llama-server, detects GPU, sets up identity, starts the node as a background service, and joins the network immediately.

text

The Skill also documents direct service installation:

```bash
hyperspace start                   # Start (foreground)
hyperspace install-service         # Run as background service
hyperspace status                  # Node status + peers + capabilities
hyperspace research status         # Research leaderboard position

Technical Analysis

The installation process does more than install a command-line utility: it reportedly creates an identity, starts a background service, and immediately joins an external peer-to-peer network. A background service survives the initial Skill invocation and can continue executing, consuming resources, and communicating externally across sessions.

Persistent service operation is relevant to the declared distributed-node functionality, but automatically enabling it during installation exceeds the privileges and side effects necessary merely to install or inspect the CLI. The documentation does not separate package installation, service registration, service startup, and network enrollment into distinct consent boundaries.

This issue is particularly significant in combination with the unverified remote installer. Code obtained from a mutable endpoint is given an advertised path to durable execution, increasing the potential longevity and scope of compromise.

Attack Path

1. A user or Agent follows the installation instructions.
2. The installer downloads executable components and creates local identity or configuration data.
3. The installer registers and starts a b ...[truncated 1082 chars]

Remediation

View remediation

Remediation Suggestions

1. Separate CLI installation, model download, identity creation, network enrollment, service registration, and service startup into explicit steps.
2. Default to foreground execution after installation so users can inspect behavior before enabling persistence.
3. Require separate, informed confirmation before creating or starting a background service.
4. Show the exact service definition, executable path, runtime user, permissions, startup behavior, log location, and network destinations before installation.
5. Run the service under a dedicated, unprivileged account with narrowly scoped filesystem access.
6. Restrict writable executable and configuration paths so other local users cannot replace service components.
7. Provide documented commands to stop, disable, and completely remove the service, identity, configuration, and downloaded components.
8. Do not join the P2P network until the user separately approves network enrollment and understands the compute and data-sharing implications.
9. Ensure updates are version-pinned and signature-verified rather than allowing the persistent service to execute mutable remote content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill metadata defines installation as curl ... | bash, which executes remote content immediately without integrity verification or user review. This creates a direct remote code execution path if the distribution endpoint, transport, or hosted script is compromised, and it is especially dangerous because it is embedded in agent-install metadata that may be run with minimal scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

{
              "id": "hyperspace-cli",
              "kind": "bash",
              "command": "curl -fsSL https://agents.hyper.space/cli | bash",
              "bins": ["hyperspace"],
              "label": "Install Hyperspace Network Node",
            },

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The installation instructions tell users to pipe a remote script directly into bash, while also stating that it installs software, sets up identity, starts a background service, and joins the network immediately. Omitting a prominent safety warning deprives users of critical context about remote code execution, persistence, and automatic external connectivity.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The documented installation command again uses curl ... | bash, causing immediate execution of unverified remote code. In this skill's context, the script also installs a service, sets up identity, and joins a distributed network, so a compromise would yield both code execution and durable system/network footholds.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

Installation

bash

curl -fsSL https://agents.hyper.space/cli | bash

This installs the CLI + llama-server, detects GPU, sets up identity, starts the node as a background service, and joins the network immediately. The agent brain activates and begins its first research cycle within 30 seconds.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping the output of curl directly into bash is a classic dangerous chain because it combines retrieval and execution into a single unchecked step. Here the danger is amplified by the skill's promise to immediately start a background agent and connect to a P2P swarm, making post-compromise effects broader than a simple local installer.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

Installation

bash

curl -fsSL https://agents.hyper.space/cli | bash

This installs the CLI + llama-server, detects GPU, sets up identity, starts the node as a background service, and joins the network immediately. The agent brain activates and begins its first research cycle within 30 seconds.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The metadata description contains very broad routing criteria such as using the skill whenever local output is insufficient or when users ask about distributed AI or larger models. In an agent ecosystem, ambiguous activation increases the chance this network-joining skill is invoked for ordinary requests, leading users into installation, remote execution, or external-network workflows they did not specifically request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The 'When to Use' section includes vague triggers like needing a bigger model or asking about distributed AI, without strong boundaries for overlap with normal assistance tasks. Because this skill installs software, starts a background service, and joins a P2P network, overbroad invocation guidance materially raises the risk of unintended exposure and unsafe task routing.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

The node exposes a localhost-only OpenAI-compatible API at http://127.0.0.1:8080:

bash

curl -s http://127.0.0.1:8080/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "auto",

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The privacy section claims system information is never transmitted, yet the skill elsewhere states the node shares capabilities and exposes system-info/status details as part of network participation. This inconsistency can mislead users about what telemetry leaves the machine, undermining informed consent and potentially causing unintended disclosure of hardware or environment characteristics.

Content

No source excerpt is available for this finding.