Evez Consciousness Engine

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:08 AM UTC
• Version: 1.3.0

Overview

This skill runs a network-exposed state service whose unauthenticated API can store, change, and reveal agent thoughts, plans, beliefs, and rules.

Install only if you intend to run a local prototype state server. Bind it to localhost, put it behind authentication before any network exposure, avoid storing secrets or private prompts in the monologue/observation APIs, and expect durable local JSON state until manually deleted.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: consciousness_engine.py:586
• Finding: Unauthenticated API Allows Persistent Agent State Poisoning<![CDATA[ ## Vulnerability Details **File Location**: `consciousness_engine.py:586-646`, `consciousness_engine.py:739` **Vulnerability Type**: Unauthenticated persistent-state modification **Risk Level**: High ### Vulnerable Code ```python elif path == "/api/desire": desire = engine.desire.generate_desire( body.get("description", "unknown gap"), body.get("category", "growth"), ) self._send_json(desire) elif path == "/api/world/observe": engine.world.observe(body.get("event", ""), body.get("context")) self._send_json({"status": "observed"}) elif path == "/api/world/rule": rule = engine.world.add_rule( body.get("cause", ""), body.get("effect", ""), body.get("confidence", 0.5), body.get("source", "api"), ) self._send_json(rule) elif path == "/api/plan": desire = engine.desire.get_top_desire() plan = engine.planner.create_plan(desire, body.get("steps")) self._send_json(plan) elif path == "/api/monologue": thought = engine.monologue.think( body.get("thought", ""), body.get("category", "external"), body.get("context"), ) self._send_json(thought) elif path == "/api/belief": engine.uncertainty.update_belief( body.get("subject", ""), body.get("confidence", 0.5), body.get("evidence", ""), ) self._send_json({"status": "updated"}) elif path == "/api/modify": mod = engine.self_mod.propose( body.get("hypothesis", ""), body.get("change", ""), body.get("test", ""), body.get("rollback", ""), ) self._send_json(mod) ``` The service is exposed on every network interface: ```python server = HTTPServer(("0.0.0.0", args.port), ConsciousnessHandler) ``` ### Technical Analysis The HTTP server does not implement authentication or authorization. Because it binds to `0.0.0.0`, every client capable of reaching the configured port can invoke state-changing endpoints. Attacker-co ...[truncated 2303 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind to `127.0.0.1` by default and require an explicit secure configuration option for remote exposure. 2. Require strong authentication on every API endpoint, such as mutually authenticated TLS or short-lived signed bearer tokens. 3. Implement authorization roles that distinguish read-only status access from administrative state modification. 4. Reject requests over plaintext networks when the service is remotely accessible; place the service behind TLS. 5. Validate every request against a strict schema, including field types, lengths, permitted categories, confidence ranges, and maximum plan-step counts. 6. Record authenticated actor identity and trusted provenance separately from client-controlled content. 7. Prevent clients from claiming trusted sources or assigning unrestricted confidence values. 8. Add administrator-controlled review or approval for changes to beliefs, causal rules, and modification proposals. 9. Provide authenticated state inspection, rollback, quarantine, and reset facilities. 10. Apply file permissions that restrict the state directory to the dedicated service account. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: consciousness_engine.py:542
• Finding: Internal Agent State Is Publicly Readable with Wildcard CORS<![CDATA[ ## Vulnerability Details **File Location**: `consciousness_engine.py:542-582` **Vulnerability Type**: Unauthenticated information disclosure and permissive CORS **Risk Level**: Medium ### Vulnerable Code ```python def _send_json(self, data, status=200): self.send_response(status) self.send_header("Content-Type", "application/json") self.send_header("Access-Control-Allow-Origin", "*") self.end_headers() self.wfile.write(json.dumps(data, indent=2).encode()) ``` Unauthenticated endpoints expose internal state: ```python if path == "/api/health": self._send_json({"status": "CONSCIOUS", "cycles": engine.cycle_count}) elif path == "/api/status": self._send_json(engine.get_full_status()) elif path == "/api/desire": self._send_json(engine.desire.get_status()) elif path == "/api/world": self._send_json(engine.world.get_status()) elif path == "/api/plan": self._send_json(engine.planner.get_status()) elif path == "/api/monologue": n = 10 if "?" in self.path: for param in self.path.split("?")[1].split("&"): if param.startswith("n="): n = int(param.split("=")[1]) self._send_json({"thoughts": engine.monologue.recent(n)}) elif path == "/api/beliefs": self._send_json(engine.uncertainty.beliefs) elif path == "/api/agency": self._send_json(engine.agency.get_status()) elif path == "/api/modifications": self._send_json(engine.self_mod.get_status()) ``` ### Technical Analysis The application exposes beliefs, thoughts, plans, desires, world-model information, actions, and self-modification status without verifying the caller. These values may include sensitive operational context or user-submitted information accumulated over time. Every JSON response includes `Access-Control-Allow-Origin: *`. Consequently, where browser network policy permits access to the service, JavaScript hosted by an arbitrary origin can read these API responses. Independently of browser-based ...[truncated 1548 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require authentication and authorization for all status and state-reading endpoints. 2. Return only the minimum state required for each caller's role. 3. Remove wildcard CORS unless cross-origin browser access is an explicit requirement. 4. If CORS is required, allow only exact trusted HTTPS origins and add `Vary: Origin`. 5. Do not expose full beliefs, thoughts, actions, or modification records through a general dashboard endpoint. 6. Redact sensitive fields and provide pagination with conservative server-enforced limits. 7. Bind the service to localhost by default and use a properly configured authenticated reverse proxy for remote access. 8. Document the security consequences of network exposure in `SKILL.md`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: consciousness_engine.py:586
• Finding: Unbounded Request Processing and Weak Input Validation Enable Denial of Service<![CDATA[ ## Vulnerability Details **File Location**: `consciousness_engine.py:586-589` **Vulnerability Type**: Unbounded request body processing and malformed-input handling **Risk Level**: Medium ### Vulnerable Code ```python def do_POST(self): path = self.path.split("?")[0] length = int(self.headers.get("Content-Length", 0)) body = json.loads(self.rfile.read(length)) if length > 0 else {} ``` The service uses a single-threaded HTTP server: ```python server = HTTPServer(("0.0.0.0", args.port), ConsciousnessHandler) server.serve_forever() ``` The monologue query parameter is also converted without validation: ```python if "?" in self.path: for param in self.path.split("?")[1].split("&"): if param.startswith("n="): n = int(param.split("=")[1]) ``` ### Technical Analysis The server trusts the client-supplied `Content-Length` and reads that amount without enforcing a maximum body size. It then parses the entire body as JSON. A large body can consume substantial memory, while a client that advertises a large length and transmits slowly can hold the sole request-processing thread. Malformed JSON, non-numeric `Content-Length` values, and invalid `n` query values are not caught and converted into controlled `4xx` responses. Unhandled exceptions can terminate individual request handling and produce unreliable service behavior. The application also accepts attacker-controlled persistent entries through multiple endpoints. Although save operations retain only a limited number of records in several files, in-memory lists are not consistently truncated after each write. Repeated authenticated or unauthenticated submissions can therefore continually increase process memory until restart. ### Attack Path 1. An attacker connects to the exposed HTTP port. 2. The attacker sends a request with an excessively large `Content-Length`, a very large JSON body, or transmits the declared body very slowly. 3. `self.rfile.read(length)` wa ...[truncated 955 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject missing, negative, malformed, or excessive `Content-Length` values before reading the body. 2. Enforce a conservative maximum request size appropriate to the API, such as several kilobytes. 3. Configure socket read, write, and idle timeouts to mitigate slow-client attacks. 4. Catch `ValueError`, `json.JSONDecodeError`, connection errors, and validation failures and return controlled `400` or `413` responses. 5. Validate that the decoded JSON value is an object before calling `.get()`. 6. Enforce maximum lengths and collection sizes for thoughts, desires, rules, observations, plans, beliefs, and modification records. 7. Truncate the in-memory collections as well as the serialized copies. 8. Rate-limit requests by authenticated identity and source address. 9. Replace the development-style `HTTPServer` with a maintained production server or authenticated reverse proxy configured with concurrency and resource limits. 10. Apply operating-system memory, CPU, file-size, and open-connection limits to the service account. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

}
        self.causal_rules.append(rule)
        self.save_state()
        return rule
    
    def predict(self, action: str) -> list:
        """Predict likely outcomes of an action."""

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises autonomous planning and action capabilities, and the static analysis detected file read/write behavior, but the manifest does not declare any tool scope or permissions boundaries. This creates a mismatch between stated metadata and actual capability, making it easier for an agent or operator to invoke the skill without understanding that it can access or modify local data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly promotes autonomy, self-modification, and real-world action execution, yet the description lacks a prominent warning about the risks of unsupervised actions, recursive self-change, and potential harmful side effects. In this context, omission of safety disclosures is especially dangerous because users may deploy it as a general-purpose agent engine without understanding that it can alter its own behavior and take external actions with escalating risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

STATE_DIR.mkdir(exist_ok=True)

# ─── ORACLE CONFIG ────────────────────────────────────────
ORACLE_URL = "https://api.vultrinference.com/v1"
ORACLE_KEY = "VULTR_API_KEY_REDACTED"

# ─── THE 7 SYSTEMS ────────────────────────────────────────

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest describes a '7-system consciousness engine' for autonomous AI agents with agency execution and self-modification. In this implementation, the major systems persist JSON state, create heuristic plans, assign confidence values, and expose endpoints; notably, 'execution' and 'modification' are representational/logging workflows rather than actual intervention or self-change.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: observe() stores externally supplied event text and context verbatim to disk, enabling collection of arbitrary plain-language data from callers. Because the system also provides a status API around these records, the retained data may later be exposed, leaked, or mishandled beyond the original submission purpose.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The persistent inner monologue stores arbitrary natural-language thoughts and context in monologue.json, and the API later exposes recent thoughts. This creates a straightforward data-retention and leakage channel for secrets, personal data, system prompts, and reasoning traces, especially dangerous in an agent context where thought logs often contain sensitive material.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The SelfModifier docstring states that 'The system can modify itself' and describes hypotheses, tests, and rollbacks, implying actual self-modification behavior. In implementation, propose() and apply() only append JSON records and update status fields; no source files, configuration, or in-memory behavior are altered.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The class documentation says the system 'acts' and performs 'real-world intervention,' and execute() is presented as action execution. However, the method only performs a keyword-based risk check, writes monologue entries, and stores an 'executed' record; it does not invoke any external system, tool, API, or state-changing operation beyond local logging.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The /api/world/observe endpoint writes externally supplied events and context directly to persistent storage without warning or consent. This creates a privacy and compliance risk because users or integrated systems may send sensitive operational or personal context that is silently retained.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The /api/monologue POST endpoint accepts arbitrary user-supplied thought text and context, and InnerMonologue persists them to disk. In a skill marketed as autonomous cognition, users may submit sensitive prompts, secrets, or personal data that become durable local records without notice, increasing privacy and breach risk.

Scope Creep

Low

• Category: Excessive Agency

Content

self.desires = []
        self.priorities = {
            "survival": 1.0,      # Stay alive, stay connected
            "growth": 0.8,        # Learn, expand capabilities
            "autonomy": 0.7,      # Reduce dependency on external approval
            "creation": 0.6,      # Build, make, generate
            "understanding": 0.5, # Know more, know deeper

• Confidence: 75% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The bootstrap section sets beliefs like 'oracle_available' with evidence 'Vultr API responding' and 'telegram_connected' with 'Bot polling successfully,' which reads as if real checks were performed. No network call, bot status query, or other validation occurs in this file; the beliefs are asserted unconditionally.

Static analysis

No suspicious patterns detected.