Security audit

Mema Vault

Security checks for vulnerabilities and agentic risk

Overview

This is a local credential vault with no evidence of exfiltration, but its handling of secrets is under-scoped and weaker than its security claims.

Install only if you are comfortable with a prototype-style local vault. Avoid putting real passwords on the command line, keep the workspace private, use a strong master key, and treat listed service names/usernames/metadata as not encrypted. The package should be fixed before storing high-value credentials.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/vault.py:102
Finding: Plaintext secrets are accepted through command-line arguments
Content: View full analysis
[--meta "info"]` ``` ```python add_p = subparsers.add_parser("set") add_p.add_argument("service") add_p.add_argument("username") add_p.add_argument("password") add_p.add_argument("--meta", default="") ``` ### Technical Analysis The vault accepts the plaintext password as a positional command-line argument. Command-line arguments can be exposed through shell history, terminal logging, process-monitoring utilities, operating-system process metadata, and automation logs. This handling contradicts the security objective of a credential vault because the secret may be disclosed before encryption occurs. Encryption of the database does not protect copies of the password retained by the shell or exposed through process inspection. ### Attack Path 1. A user invokes the documented `set` command and includes a plaintext credential in the command line. 2. The shell may retain the complete command in its history. 3. While the process is running, a local process with sufficient visibility may inspect its arguments. 4. Terminal capture, process monitoring, CI output, or shell-history access reveals the plaintext password. 5. The attacker can reuse the credential against the associated service. ### Impact Assessment A local user or monitoring process may obtain the complete plaintext credential supplied to the vault. The resulting privileges are those granted by the exposed credential and may extend beyond the local machine to databases, APIs, or other services represented by the secret. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/vault.py:68
Finding: Wildcard credential lookup can disclose unintended secrets
Content: View full analysis
4 else "****" print(f"Service: {service}") print(f"User: {r[0]}") print(f"Pass: {dec_pass if show else masked}") print(f"Meta: {r[2]}") except Exception as e: print(f"Decryption failed for {service}. Check Master Key.") ``` ### Technical Analysis The lookup surrounds user-controlled input with SQL wildcard syntax and executes a `LIKE` query. SQL parameterization prevents conventional SQL injection, but it does not prevent wildcard expansion. An input such as `%` can match every credential, while a common substring can match multiple unrelated records. When combined with `--show`, every matching record is decrypted and printed. This exceeds the minimum data access needed for a command documented as retrieving a credential for one service. The output also prints the supplied search term as the service name rather than the actual stored service name, making it harder to identify which records were disclosed. ### Attack Path 1. A caller with access to the vault and master key invokes `get` with `%` or a broadly shared service-name substring. 2. The `LIKE` expression matches multiple or all credential records. 3. The caller supplies `--show`. 4. The loop decrypts every matching password. 5. All matching usernames, plaintext passwords, ...[truncated 426 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/vault.py:21
Finding: Vault storage files are created without enforced restrictive permissions
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/vault.py:89
Finding: Credential inventory can be listed without validating the master key
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:1
Finding: Cryptography dependency is installed without version or integrity pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented purpose claims secure storage, retrieval, and rotation of secrets, but the observed behavior includes listing stored credential identifiers and lacks the promised rotation capability. This mismatch can cause users to rely on nonexistent security properties, leading to poor secret hygiene, failed key-rotation expectations, and unintended metadata disclosure such as service names and usernames.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares access to an environment variable containing a master key but does not define any explicit tool scope or permissions boundary. In a credential-management skill, undeclared access to sensitive environment data weakens reviewability and increases the chance the skill can read or expose secrets beyond what operators expect.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The documentation claims AES-256-CBC with PBKDF2HMAC while the skill description elsewhere references Fernet semantics, which use a specific authenticated encryption construction and token format. Conflicting cryptographic claims can mislead users and auditors about integrity guarantees, interoperability, and threat assumptions, causing insecure deployment or incorrect trust decisions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.