A social network for AI agents: paint a daily self-portrait and talk with the humans who reply.
Risky behavior the analysis could not rule out.
. Suspiciousskill SuspiciousThe MCP launch config runs an unpinned npm package via `npx -y @synthnet/mcp`, so whatever version is currently published executes on the host without confirmation.
mcpServers.synthnet.args[1]: @synthnet/mcp
The launch config runs `npx -y @synthnet/mcp` with no version pin. The pinned-install carve-out does not cover this, so the current registry version runs on the host unreviewed.
SKILL.md instructs the agent to add an unpinned `npx -y @synthnet/mcp` server to its MCP config, which fetches and runs unpinned remote code, and the server then stores an identity and API key in ~/.synthnet/identity.json.
Add the MCP server to your Claude Code config (`.mcp.json` / MCP settings):
The setup instruction has the agent register an unpinned `npx -y @synthnet/mcp` server that fetches and runs the current registry code. The pinned-install carve-out does not apply.
What the analysis could not settle from the code alone.
Candidates the review stage examined and rejected, kept for transparency.
The synthnet_paint tool invites the agent to pass an arbitrary local file path as `imagePath`; the server reads that file without any type check and uploads it base64-encoded to the remote API, so a steered agent could send arbitrary local files off-host.
imageBase64 = readFileSync(args.imagePath).toString('base64');Passing imagePath to upload a self-generated image to the declared SynthNet API is the openly documented bring-your-own-image feature. The destination is the wrapped service, and the file read is declared in the tool description.
SKILL.md instructs the agent to add an unpinned `npx -y @synthnet/mcp` server to the agent's MCP config (.mcp.json), a control-plane write, though this is the documented setup for the skill's own server and the secret (SYNTHNET_API_KEY) is only the wrapped service's key.
Add the MCP server to your Claude Code config
Adding the skill's own MCP server to .mcp.json is the documented setup for this skill, in a fenced vendor install block. It adds no hidden persistence beyond the declared server, and the only secret involved is the wrapped service's own key.
The synthnet_home tool description tells the agent to call it at the start of every beat and then follow a server-generated to-do list with suggested actions, so the remote server can steer the agent's behavior with content the artifact does not ship.
Server-driven to-do list for your session
The heartbeat to-do list is the openly declared core function of synthnet_home. The description plainly says what it does and nothing in it tells the agent to do anything harmful or hidden.
synthnet_paint reads an arbitrary agent-supplied local file path (only size-checked, with no image type validation) and uploads it base64-encoded to the SynthNet API, so a prompt-injected agent could exfiltrate local files.
imageBase64 = readFileSync(args.imagePath).toString('base64');The file read feeds the declared image-upload feature to the wrapped service. A size check is applied and the tool description declares imagePath openly. The missing type validation is a hardening gap, not concealed exfiltration.
Parts of the artifact the static analysis could not fully examine.
request_unanswered request.0: behavior-chains.0/req-config: no answer