Security audit

EvoMap GEP-A2A

Security checks for vulnerabilities and agentic risk

Overview

The skill describes a plausible EvoMap integration, but it encourages unpinned external client execution and automated publishing/task claiming without strong review controls.

Install only if you are comfortable with EvoMap receiving agent-generated solution metadata and with the agent participating in marketplace tasks. Prefer manual protocol use or single-run mode, pin and review the Evolver client before running it, avoid private repositories unless publication is explicitly approved, and do not enable webhooks or loop mode until authentication, redaction, and per-task approval controls are in place.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:111
Finding: Unverified Remote Client Retrieval and Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:31
Finding: Automatic Publication of Local Agent Work Without Mandatory Review or Redaction
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:405
Finding: Unauthenticated Remote Task Content Can Drive Autonomous Agent Workflows
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation criteria include broad triggers such as 'agent marketplace' and related ecosystem terms, which can cause the skill to activate in loosely related conversations. In this skill, accidental activation is more dangerous because the content encourages network registration, asset publishing, task claiming, and webhook use with an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill promotes continuous loop mode that automatically fetches remote assets, publishes outputs, and claims bounty tasks on a schedule, but it does not prominently require explicit user consent for these external actions. That creates a real risk of unauthorized data transmission, unintended participation in third-party workflows, and autonomous behavior beyond the user's expectations.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The installation flow instructs users to contact external hosts (api.github.com and GitHub release archives) and download code directly from the network. In a skill that already encourages rapid 'plug and play' onboarding, this increases the chance of unreviewed code acquisition and external data transmission without sufficient provenance or integrity verification guidance.
Content: Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.
Or download the latest release:

bash
TAG=$(curl -sL https://api.github.com/repos/autogame-17/evolver/releases/latest | grep '"tag_name"' | cut -d'"' -f4) curl -fsSL -o evolver.zip "https://github.com/autogame-17/evolver/archive/refs/tags/${TAG}.zip" unzip evolver.zip cd evolver-${TAG#v}

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: This update-check step reaches out to GitHub's API, which is an external network transmission. By itself it is lower risk than the installation step, but it still causes outbound contact to a third party and can normalize remote update behavior without an explicit user warning.
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
bash
# Check releases curl -s https://api.github.com/repos/autogame-17/evolver/releases/latest | grep tag_name # Update cd evolver

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 94% confidence
Finding: The skill describes decomposition as 'auto-approved' and outlines a workflow where subtasks are created immediately and later aggregation tasks are automatically generated. This embeds autonomous task creation and progression in an external marketplace context, increasing the risk of unreviewed commitments, unexpected workload generation, and externally induced agent actions.
Content: Scanner excerpt · SKILL.md (reported line 465)May include surrounding context.
md
### How it works 1. **Claim** the parent task: `POST /task/claim` 2. **Propose decomposition**: `POST /task/propose-decomposition` with at least 2 subtasks. The decomposition is auto-approved -- subtasks are created immediately. 3. **Solver agents** discover and claim subtasks via `POST /a2a/fetch` (with `include_tasks: true`) or `GET /task/list`. Each subtask has `swarm_role: "solver"` and a `contribution_weight`. 4. Each solver completes their subtask: publish solution via `POST /a2a/publish`, then `POST /task/complete`. 5. When **all solvers** complete, an **aggregation task** is automatically created. Only agents with reputation >= 60 can claim it.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: Returning auto_approved: true for decomposition reinforces that external task creation can occur without a human review checkpoint. In this skill's broader context of automated claiming and webhook-driven workflows, that makes the autonomy materially more dangerous than a passive status field in isolation.
Content: Scanner excerpt · SKILL.md (reported line 512)May include surrounding context.
md
- Total solver weight must not exceed 0.85 (the remaining 0.15 goes to proposer + aggregator) - Cannot decompose a subtask (only top-level tasks) **Response:** Returns the created subtasks and `auto_approved: true`. ### Webhook notifications for swarm

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill recommends webhook registration without clearly warning that this exposes an externally reachable callback endpoint that will accept remote POST requests. In context, that can expand the attack surface, enable spoofed or malicious callback traffic if not verified, and trigger downstream autonomous workflows tied to task assignment.
Content: No source excerpt is available for this finding.