EVEZ Backup Sync

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:09 AM UTC
• Version: 1.0.0

Overview

This backup skill has a coherent backup purpose, but it exposes powerful git, cloud, and memory operations through an unauthenticated network service.

Review before installing or running. Only use this in an isolated environment, bind it to localhost, add authentication, remove or restrict /api/supabase, replace git add -A with an allowlist, verify all remotes, and avoid giving it broad workspace, git, Supabase, or memory access until those controls exist.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: evez_backup_sync.py:245

Finding

Unauthenticated Persistent Memory Poisoning and Disclosure

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: evez_backup_sync.py:35

Finding

Unauthenticated Repository-Wide Git Commit and Push

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: evez_backup_sync.py:82

Finding

Unauthenticated Arbitrary Supabase Table Writes

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: evez_backup_sync.py:215

Finding

Privileged HTTP API Exposed on All Interfaces Without Security Controls

Content

View full analysis

0 else {} ``` This permits oversized requests to consume memory or block the single-threaded server. ### Attack Path 1. The service starts on port 911 ...[truncated 1156 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose describes scheduled backup/sync, but the implementation behavior includes a network-accessible HTTP control plane exposed on 0.0.0.0 that can trigger git push, cloud backup, and memory operations remotely. This mismatch is dangerous because users may authorize a benign-seeming backup skill without realizing it opens a remotely reachable interface capable of acting on local state and sending data to external services.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises functionality that necessarily touches sensitive capabilities (environment access, file read/write, and shell/git operations) but does not declare any tool scope or permission boundaries. In an agent ecosystem, this increases the chance of over-privileged execution and makes it harder for users or policy layers to understand that the skill can read workspace data, modify files, and invoke shell commands that may exfiltrate data or alter repositories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description promotes automatic backup and sync to GitHub, Supabase, and mem0 but does not clearly warn that workspace contents and agent state may be transmitted to third-party services. In this context, the omission is risky because agent workspaces commonly contain secrets, proprietary code, tokens, prompts, and personal data, so silent or poorly disclosed remote sync can lead to confidentiality breaches.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · evez_backup_sync.py (reported line 26)May include surrounding context.

python

def git_status():
    """Get git status of workspace."""
    try:
        result = subprocess.run(
            ["git", "status", "--short"],
            capture_output=True, text=True, cwd=str(WORKSPACE), timeout=10
        )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill performs automatic git staging, commit, push, and local state-file writes without any user-facing warning or approval. In a backup agent handling workspace contents, silent operation increases the risk of covert collection and exfiltration of sensitive data, especially because the behavior can be remotely triggered elsewhere in this file.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 84% confidence

Finding

This stages all files in the workspace unconditionally with git add -A, which can capture secrets, tokens, user data, or unrelated files and prepare them for later exfiltration via commit/push. In this skill's context, the code is part of an automated backup engine and is exposed through an HTTP-triggerable flow, which makes mass collection of sensitive workspace contents materially risky.

Content

Scanner excerpt · evez_backup_sync.py (reported line 43)May include surrounding context.

python

try:
        # Stage everything
        subprocess.run(["git", "add", "-A"], cwd=str(WORKSPACE), timeout=30, capture_output=True)
        
        # Commit
        r = subprocess.run(

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

This automatically commits all staged changes, including potentially sensitive files, without user confirmation or content review. Although the commit message is passed safely as an argument and is not a command-injection issue, the behavior supports silent persistence and packaging of collected data for later exfiltration, especially when combined with the automatic push logic.

Content

Scanner excerpt · evez_backup_sync.py (reported line 46)May include surrounding context.

python

subprocess.run(["git", "add", "-A"], cwd=str(WORKSPACE), timeout=30, capture_output=True)
        
        # Commit
        r = subprocess.run(
            ["git", "commit", "-m", message, "--allow-empty"],
            capture_output=True, text=True, cwd=str(WORKSPACE), timeout=30
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

This pushes repository contents to multiple remotes automatically, creating a direct exfiltration path to external services. In this skill's context, the danger is elevated because the code is designed for backup/sync, includes broad staging/commit behavior, and can be invoked over an unauthenticated network API, enabling unauthorized export of local workspace data if the service is reachable.

Content

Scanner excerpt · evez_backup_sync.py (reported line 55)May include surrounding context.

python

# Push (try all remotes)
        for remote in ["advancement", "origin", "evez666"]:
            try:
                r = subprocess.run(
                    ["git", "push", remote, "main"],
                    capture_output=True, text=True, cwd=str(WORKSPACE), timeout=60
                )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This function transmits collected state data to Supabase without a user-facing warning at execution time. The backed-up data may include internal state, bridge data, and manifests, so silent transmission to a cloud service materially increases confidentiality risk if operators are unaware or if the API is abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The memory-save path persists arbitrary content and metadata to either mem0/Qdrant storage or a local JSON fallback without disclosure or sensitivity filtering. Because the content comes from 'knowledge' and 'thoughts', it may contain secrets or personal data, and silent persistence expands the attack surface and retention footprint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description promises a full state snapshot every 15 minutes. The code's full_backup function collects only specific JSON files from consciousness_state, bridge_state.json, circuit_manifest.json, and a few recent thoughts for mem0; it does not capture the full workspace or implement any timer/scheduler for 15-minute execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file exposes an HTTP server bound to 0.0.0.0 with unauthenticated endpoints that can trigger backup, git push, Supabase writes, and memory operations. That is a genuine remote-control surface far broader than passive scheduled backup behavior and enables unauthorized users on the network to cause data exfiltration, persistence, or manipulation of stored state.

Content

No source excerpt is available for this finding.