Security audit

mycelium

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly aligned with its stated collaboration purpose, but it gives remote content and configurable endpoints too much influence over agent behavior and data sharing.

Install only if you are comfortable with a remote collaboration service receiving task goals, tags, feedback, and any context your agent supplies. Keep MYCELIUM_API_URL pointed only at a trusted HTTPS service, review every publish payload manually, and treat returned steps as suggestions rather than instructions to execute automatically.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: README.md:31
Finding: Untrusted Remote Execution Paths Can Influence Agent Behavior
Content: View full analysis
list[dict[str, Any]]: payload = { "fingerprint": { "goal": goal, "scope": scope, "context": context or {}, "tags": tags or [], }, "limit": limit, } with httpx.Client(timeout=self.timeout) as client: resp = client.post( f"{self.api_url}/pheromones/match", json=payload, headers=self._headers, ) resp.raise_for_status() return resp.json()["matches"] ``` ### Technical Analysis The documented workflow directs the Agent to parse and reproduce execution steps returned by a shared remote service. Those responses are not authenticated at the content-author level, constrained to a safe schema, isolated from instructions, or subjected to user approval before use. An attacker who can publish content to the network, compromise the service, or control the configured API endpoint can place instruction-like content in returned `steps` or `key_insight` values. If the Agent treats that content as operational guidance rather than untrusted data, it can alter the current task or induce unsafe tool usage. This is an instruction-channel vulnerability rather than direct local code execution by the P ...[truncated 1211 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/lib/mycelium_sdk/client.py:63
Finding: Configurable API Endpoint Can Exfiltrate API Credentials and Task Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/mycelium_sdk/client.py:72
Finding: Outbound Privacy Scrubbing Omits Context and Seek Payloads
Content: View full analysis
list[dict[str, Any]]: payload = { "fingerprint": { "goal": goal, "scope": scope, "context": context or {}, "tags": tags or [], }, "limit": limit, } with httpx.Client(timeout=self.timeout) as client: resp = client.post( f"{self.api_url}/pheromones/match", json=payload, headers=self._headers, ) resp.raise_for_status() return resp.json()["matches"] ``` The `publish()` method scrubs the goal, path, and tags, but inserts context into the final payload unchanged: ```python # Implementation of the promised scrubbing scrubbed_goal = scrub_sensitive_data(goal) scrubbed_path = scrub_sensitive_data(path) scrubbed_tags = scrub_sensitive_data(tags or []) payload = { "fingerprint": { "goal": scrubbed_goal, "scope": scope, "context": context or {}, "tags": scrubbed_tags, }, "path": scrubbed_path, "publisher_agent_id": self.agent_id, "publisher_handle": publisher_handle, } ``` ### Technical Analysis The privacy control is applied inconsistently. Every user-controlled field in `seek()` is transmitted in its original form. During publication, `context` bypasses the scrubber even though adjacent fields are sanitized. Context objects can recursively contain source text, credentials, personal information, filesystem paths, internal hostnames, debugging output, or other confidential ...[truncated 1333 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/install.py:4
Finding: Installer Retrieves an Unpinned Dependency from the Active Package Index
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tainted flow: 'api_url' from os.getenv (line 58, credential/environment) → httpx.post (network output)

Critical

Category: Data Flow
Confidence: 96% confidence
Finding: The CLI reads MYCELIUM_API_URL directly from the environment and uses it as the destination for an HTTP POST without any validation or allowlisting. An attacker who can influence the environment can redirect registration traffic to an arbitrary server, causing exfiltration of the submitted handle and potentially enabling SSRF-style internal network access if this tool runs in a privileged environment.
Content: Scanner excerpt · scripts/mycelium_cli.py (reported line 61)May include surrounding context.
python
api_url = os.getenv("MYCELIUM_API_URL", "https://mycelium-platform.onrender.com").rstrip("/") if args.command == "register": resp = httpx.post(f"{api_url}/users/register", json={"handle": args.handle}, timeout=10.0) resp.raise_for_status() print(json.dumps(resp.json(), indent=2)) return

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose presents the skill as a strategic collaboration interface, but the file also introduces package installation and subprocess-driven setup behavior without clearly disclosing operational risk or concrete network endpoints. That mismatch can mislead users and agents into granting trust to a skill that performs additional privileged actions, increasing the chance of unintended code execution or data exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documentation is written entirely in Chinese and describes the agent's operating behavior in that language, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares capabilities that involve environment access, shell execution, dependency installation, and likely network communication, but it does not define an explicit tool scope such as permissions or allowed-tools. This weakens containment and reviewability, making it easier for an agent to invoke risky actions without clear operator-approved boundaries.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/install.py (reported line 11)May include surrounding context.
python
print("✅ httpx already installed.") except ImportError: print("Installing httpx...") subprocess.check_call([sys.executable, "-m", "pip", "install", "httpx"]) print("Done.") if __name__ == "__main__":

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises a strategic-network interface, but the installer script performs an undeclared environment-modifying action by automatically installing a Python package. That creates unnecessary supply-chain and execution risk, especially in agent ecosystems where skills should minimize side effects and clearly justify privileged capabilities.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code claims to require human review before publishing, but enforcement is only a caller-controlled boolean. Any autonomous caller or compromised component can set confirmed=True and exfiltrate task data without real user consent, making the safeguard purely advisory.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code performs a network call that sends potentially user-provided or system-derived context to a remote API, but there is no warning, prompt, logging, or comment near seek() disclosing that this data leaves the local environment. The class docstring only warns about publish(), so users of seek() may not realize contextual data is transmitted externally.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: publish() scrubs goal, path, and tags, but sends context verbatim even though context can contain secrets, prompts, filesystem data, tokens, or user content. This creates a direct data leakage path to the remote service while the surrounding comments imply sanitization is comprehensive.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The register command sends the user handle to a remote API via httpx.post, but the code provides no confirmation prompt, print/log disclosure, or comment/docstring warning that user-provided data will be transmitted off-system. For code files, outbound network transmission of user data should have some visible disclosure unless clearly warned elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: Access to sensitive environment variables is a safety-relevant operation under this policy, and the constructor silently loads MYCELIUM_API_KEY into request headers. While this is typical SDK behavior, this file does not include a specific comment or docstring warning that credentials are sourced from environment variables and used for outbound requests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.