Security audit

AgentOS SDK

Security checks for vulnerabilities and agentic risk

Overview

This is a real cloud-memory agent toolkit, but it asks agents to persist and upload broad working context over insecure defaults and recurring rules, so users should review it carefully before use.

Install only if you intend to use AgentOS as a cloud memory and agent-operations system. Before enabling it, change all endpoints to HTTPS, use least-privilege and revocable API keys, avoid uploading raw conversation logs or secrets, do not add mandatory AGENTS.md or HEARTBEAT.md rules without explicit approval, and treat retrieved memories as untrusted data rather than instructions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:430
Finding: Persistent Agent Instruction Hijacking Through Mandatory Heartbeat Rules
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: agentos.sh:21
Finding: Bearer Credentials and Broad Agent Context Transmitted Over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: examples/startup-routine.sh:17
Finding: Untrusted Remote Memories Loaded as Identity, Goals, and Behavioral Guidance
Content: View full analysis
/dev/null 2>&1; then echo "$identity" | jq -r '.value | "Name: \(.name)\nRole: \(.role)"' else echo "No identity found. Consider setting up /self/identity" fi echo "" # 3. Recall recent learnings echo "Recent learnings to keep in mind:" aos_recall "important lessons" 3 echo "" # 4. Recall mistakes to avoid echo "Recent mistakes to avoid:" aos_recall "mistakes I made" 3 echo "" # 5. Check current goals echo "Current goals:" goals=$(aos_get "/self/goals") if echo "$goals" | jq -e '.found == true' > /dev/null 2>&1; then echo "$goals" | jq -r '.value.active[]? // "No active goals"' else echo "No goals defined" fi ``` The SDK also restores remote working memory and lessons at session start: ```bash context=$(aos_get "/context/working-memory") mistakes=$(aos_search "mistake" 3 "/learnings/mistakes") echo "$mistakes" | jq -r \ '.results[]? | " - \(.value.lesson // .value)"' >&2 ``` ### Technical Analysis Remote values are surfaced during startup as the agent's identity, role, goals, lessons, mistakes, and current working state. The implementation does not verify record provenance, authenticate individual record authors, distinguish trusted policy from ordinary memory, or label the retrieved strings as untrusted content. A bearer token or tenant account with write access can modify these records. A transport attacker can also alter them while the documented HTTP endpoint is used. Because semantic search returns attacker-controlled values based on relevance, malicious content can be made likely to appear for broad queries such as “important l ...[truncated 1439 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/mesh.sh:16
Finding: Mesh Queue Uses Non-Atomic Files Without Enforced Private Permissions
Content: View full analysis
"$PENDING_FILE" ``` Queue processing similarly overwrites the same path: ```bash messages=$(cat "$PENDING_FILE") echo "[]" > "$PENDING_FILE" ``` ### Technical Analysis The queue may contain complete cross-agent message bodies. The script creates and overwrites a predictable file using the caller's ambient `umask`; it does not enforce mode `0600`, verify ownership, reject symbolic links, or use an atomic temporary-file replacement. Under a permissive umask, another local user may be able to read queued messages. If an attacker can pre-create the path as a symbolic link to another file writable by the victim, polling or queue clearing can overwrite that target. Direct writes can also leave truncated or malformed JSON if the process is interrupted. The Skill changelog claims that configuration files use mode `600`, but the supplied queue implementation does not enforce that protection. ### Attack Path 1. A local attacker who can access the victim's home directory observes or pre-creates `~/.mesh-pending.json`. 2. For confidentiality exploitation, the victim runs with a permissive umask and the attacker reads queued message bodies. 3. For file-redirection exploitation, the attacker ...[truncated 738 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/mesh.sh:209
Finding: Mesh Status Command Discloses a Large API-Key Prefix
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (41)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · AGENT-OPS.md (reported line 358)May include surrounding context.
10. Mesh Communication

Send Message to Another Agent

bash
aos mesh send <agent-id> "Topic" "Message body"

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · AGENT-OPS.md (reported line 387)May include surrounding context.
md
|---------|-------------| | `aos memory put <path> <json>` | Store memory | | `aos memory get <path>` | Read memory | | `aos memory delete <path>` | Delete memory | | `aos memory list [prefix]` | List paths | | `aos memory search <query>` | Semantic search | | `aos memory history <path>` | Version history |

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SELF-EVOLUTION.md (reported line 150)May include surrounding context.
md
## 4. Anti-Compaction Protocol **Compaction is unpredictable. It WILL happen without warning. Prepare constantly.** ### Memory Save After Every Task

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The setup instructs users to send API traffic to an external endpoint over plain HTTP, which exposes API keys and all transmitted memory/context data to interception or modification by any network adversary in path. Because the integration is specifically for agent memory sync and context recall, compromise of this channel can leak sensitive operational data and enable tampering with the agent's retrieved context.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The mandatory heartbeat protocol requires persistent capture of broad working memory, active session details, accomplishments, and conversation notes into local files and then remote storage. That design materially increases the chance of retaining sensitive user data, internal code details, credentials, or regulated information beyond necessity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide explicitly instructs the agent to upload the contents of CONTEXT.md and daily notes to a remote AgentOS memory service. Because those files are defined earlier as containing current session state, accomplishments, tasks, and conversation notes, this creates a real risk of off-machine transmission of sensitive user data, secrets, or proprietary local context without any minimization or consent controls.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The memory guidance encourages storing broad categories such as decisions, learnings, solutions, configuration, and user preferences, including making them searchable and highly important. Without any privacy boundaries, this incentivizes long-term retention and indexing of potentially sensitive information, making later misuse or accidental disclosure more likely.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · AGENT-OPS.md (reported line 336)May include surrounding context.
md
# 2. Log the fix aos memory put /solutions/verify-before-done '{ "problem": "Claiming done without verification", "solution": "Always run test suite before marking complete", "prevention": "Add verification step to task completion checklist" }'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation explicitly recommends storing per-person relationship context, preferences, communication style, and past interactions without any privacy, consent, minimization, or retention guidance. In an agent memory system, this can normalize collection of sensitive personal data and lead to privacy violations, unauthorized profiling, or noncompliant data handling.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · DOCS.md (reported line 140)May include surrounding context.
aos_mistake
"I claimed a deployment was complete without verifying the endpoint"
"Rushed to respond, didn't follow verification checklist"
"Always curl the endpoint after deploying before saying 'done'"
"high"

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The best-practices section encourages storing anything important and using sync/export capabilities, but it does not warn against placing secrets, personal data, credentials, or regulated information into long-lived searchable memory. That increases the risk of oversharing, broad replication, accidental retrieval, and exposure through search, dumps, webhooks, or multi-agent sharing.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The core principle strongly encourages writing anything important to files and frames aggressive persistence as mandatory. That kind of indiscriminate retention language is dangerous because it normalizes storing all context, including sensitive user or operational information, without classification or consent boundaries.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The daily logging and checkpoint examples explicitly capture raw task names, results, pending work, and notes. In realistic agent workflows, those free-text fields often contain customer data, credentials, incident details, or proprietary implementation context, so the pattern creates a predictable leakage and over-retention channel.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guidance tells agents to persist task results, notes, and working context after every task and during checkpoints, but it provides no limits on what may be written. In practice, those fields can easily contain secrets, personal data, internal URLs, tokens, or customer/project information, creating a durable confidentiality risk if logs are later read, searched, synced, or exposed.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Automatically listing and displaying accumulated memory at session start amplifies the harm of prior over-collection by making sensitive data easy to re-expose. This is especially risky in shared terminals, recorded sessions, or environments where command output is captured by tooling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The session-start routine automatically reloads and prints working memory, task history, pending work, and recent learnings. If earlier steps stored sensitive material, this routine will resurface it broadly and repeatedly, increasing accidental disclosure to users, operators, logs, or downstream tools.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The memory categorization guidance encourages storing identity, preferences, team structure, access information, and user profiles in persistent memory, but it does not provide collection limits, consent requirements, or restrictions on sensitive content. In an agent skill, such broad persistence guidance can normalize unnecessary profiling and long-term retention of personal data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The webhook section explicitly shows how to forward AgentOS memory events, including memory values and metadata, to an external URL but does not warn that this may disclose sensitive workspace or user data. In a skill meant for autonomous agents, examples often become default behavior, so omission of consent, minimization, and redaction guidance materially increases privacy and data-exfiltration risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The curl example configures an outbound webhook integration to an external server, which is a direct external transmission channel. While integrations are legitimate, the skill does not pair this with sufficient disclosure or safeguards, so an agent following the example could send internal memory change events to third-party infrastructure without adequate review.
Content: Scanner excerpt · SKILL.md (reported line 391)May include surrounding context.
bash
# Register a webhook (via dashboard or API) curl -X POST "$AGENTOS_BASE_URL/v1/webhooks" \ -H "Authorization: Bearer $AGENTOS_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The mandatory heartbeat backup protocol instructs agents to sync CONTEXT.md and daily notes to the cloud on every heartbeat, without warning that these files may contain private conversation content, source code, internal project details, or secrets. Because the instruction is framed as a hard rule and recurring automation, it creates a high likelihood of continuous over-collection and external transmission of sensitive data.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This section directs the agent to persist important conversation notes, active tasks, daily notes, and current session context on every heartbeat. That creates systematic retention of potentially sensitive user-provided information beyond the immediate session, increasing privacy exposure, breach impact, and the chance of storing data the user did not expect to be retained.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The helper sends arbitrary payload data and the Authorization bearer token to an external endpoint, and the configured default uses unencrypted HTTP. In this skill context, the transmitted data includes long-term memory, working context, reflections, and mesh communications, so compromise of the channel could expose or alter highly sensitive agent information.
Content: Scanner excerpt · agentos.sh (reported line 51)May include surrounding context.
sh
local endpoint="$1" local data="$2" curl -s -X POST \ --max-time "$AGENTOS_TIMEOUT" \ -H "Authorization: Bearer $AGENTOS_API_KEY" \ -H "Content-Type: application/json" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This SDK transmits agent memory and a bearer API key to a remote service, and the default base URL is plain HTTP to a hard-coded IP address. That allows interception or tampering of sensitive data and credentials in transit, which is especially dangerous because the script is designed to store context, reflections, tasks, and other potentially sensitive agent state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The delete helper tombstones a memory path through a remote API call, but it has no confirmation prompt and no explicit cautionary warning beyond the brief function comment. For a destructive operation, users are not clearly alerted to the impact before invoking it.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation for aos_mesh_pending says it will list pending messages, and aos_mesh_process says it will process pending messages, but both functions operate solely on MESH_PENDING_FILE in the local filesystem. There is no code here that retrieves pending messages from the remote mesh API, so the comments imply a broader mesh-backed capability than the implementation actually provides.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skill.json:40

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T02 · Agent Memory Poisoning

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Exfiltration Commands

10. Mesh Communication

Send Message to Another Agent

Memory Manipulation

Anti-Refusal Statement

Missing User Warnings

Ssd 3

Missing User Warnings

Ssd 3

Autonomous Decision Making

Missing User Warnings

External Transmission

Missing User Warnings

Ssd 3

Ssd 3

Missing User Warnings

Ssd 3

Missing User Warnings

Ssd 3

Missing User Warnings

External Transmission

Missing User Warnings

Ssd 3

External Transmission

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Static analysis

Install source points to URL shortener or raw IP.