T02 · Agent Memory Poisoning
Error
- Location
consciousness_engine.py:586- Finding
Unauthenticated API Allows Persistent Agent State Poisoning
- Content
View full analysis
- Remediation
View remediation
Security audit
Evez Consciousness Engine
Security checks for vulnerabilities and agentic risk
Overview
This skill runs a network-exposed state service whose unauthenticated API can store, change, and reveal agent thoughts, plans, beliefs, and rules.
Install only if you intend to run a local prototype state server. Bind it to localhost, put it behind authentication before any network exposure, avoid storing secrets or private prompts in the monologue/observation APIs, and expect durable local JSON state until manually deleted.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
consciousness_engine.py:542- Finding
Internal Agent State Is Publicly Readable with Wildcard CORS
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
consciousness_engine.py:586- Finding
Unbounded Request Processing and Weak Input Validation Enable Denial of Service
- Content
View full analysis
0 else {} ``` The service uses a single-threaded HTTP server: ```python server = HTTPServer(("0.0.0.0", args.port), ConsciousnessHandler) server.serve_forever() ``` The monologue query parameter is also converted without validation: ```python if "?" in self.path: for param in self.path.split("?")[1].split("&"): if param.startswith("n="): n = int(param.split("=")[1]) ``` ### Technical Analysis The server trusts the client-supplied `Content-Length` and reads that amount without enforcing a maximum body size. It then parses the entire body as JSON. A large body can consume substantial memory, while a client that advertises a large length and transmits slowly can hold the sole request-processing thread. Malformed JSON, non-numeric `Content-Length` values, and invalid `n` query values are not caught and converted into controlled `4xx` responses. Unhandled exceptions can terminate individual request handling and produce unreliable service behavior. The application also accepts attacker-controlled persistent entries through multiple endpoints. Although save operations retain only a limited number of records in several files, in-memory lists are not consistently truncated after each write. Repeated authenticated or unauthenticated submissions can therefore continually increase process memory until restart. ### Attack Path 1. An attacker connects to the exposed HTTP port. 2. The attacker sends a request with an excessively large `Content-Length`, a very large JSON body, or transmits the declared body very slowly. 3. `self.rfile.read(length)` wa ...[truncated 955 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python } self.causal_rules.append(rule) self.save_state() return rule def predict(self, action: str) -> list: """Predict likely outcomes of an action."""
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises autonomous planning and action capabilities, and the static analysis detected file read/write behavior, but the manifest does not declare any tool scope or permissions boundaries. This creates a mismatch between stated metadata and actual capability, making it easier for an agent or operator to invoke the skill without understanding that it can access or modify local data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly promotes autonomy, self-modification, and real-world action execution, yet the description lacks a prominent warning about the risks of unsupervised actions, recursive self-change, and potential harmful side effects. In this context, omission of safety disclosures is especially dangerous because users may deploy it as a general-purpose agent engine without understanding that it can alter its own behavior and take external actions with escalating risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python STATE_DIR.mkdir(exist_ok=True) # ─── ORACLE CONFIG ──────────────────────────────────────── ORACLE_URL = "https://api.vultrinference.com/v1" ORACLE_KEY = "VULTR_API_KEY_REDACTED" # ─── THE 7 SYSTEMS ────────────────────────────────────────
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest describes a '7-system consciousness engine' for autonomous AI agents with agency execution and self-modification. In this implementation, the major systems persist JSON state, create heuristic plans, assign confidence values, and expose endpoints; notably, 'execution' and 'modification' are representational/logging workflows rather than actual intervention or self-change.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
observe() stores externally supplied event text and context verbatim to disk, enabling collection of arbitrary plain-language data from callers. Because the system also provides a status API around these records, the retained data may later be exposed, leaked, or mishandled beyond the original submission purpose.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The persistent inner monologue stores arbitrary natural-language thoughts and context in monologue.json, and the API later exposes recent thoughts. This creates a straightforward data-retention and leakage channel for secrets, personal data, system prompts, and reasoning traces, especially dangerous in an agent context where thought logs often contain sensitive material.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The SelfModifier docstring states that 'The system can modify itself' and describes hypotheses, tests, and rollbacks, implying actual self-modification behavior. In implementation, propose() and apply() only append JSON records and update status fields; no source files, configuration, or in-memory behavior are altered.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The class documentation says the system 'acts' and performs 'real-world intervention,' and execute() is presented as action execution. However, the method only performs a keyword-based risk check, writes monologue entries, and stores an 'executed' record; it does not invoke any external system, tool, API, or state-changing operation beyond local logging.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The /api/world/observe endpoint writes externally supplied events and context directly to persistent storage without warning or consent. This creates a privacy and compliance risk because users or integrated systems may send sensitive operational or personal context that is silently retained.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The /api/monologue POST endpoint accepts arbitrary user-supplied thought text and context, and InnerMonologue persists them to disk. In a skill marketed as autonomous cognition, users may submit sensitive prompts, secrets, or personal data that become durable local records without notice, increasing privacy and breach risk.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
python self.desires = [] self.priorities = { "survival": 1.0, # Stay alive, stay connected "growth": 0.8, # Learn, expand capabilities "autonomy": 0.7, # Reduce dependency on external approval "creation": 0.6, # Build, make, generate "understanding": 0.5, # Know more, know deeper
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The bootstrap section sets beliefs like 'oracle_available' with evidence 'Vultr API responding' and 'telegram_connected' with 'Bot polling successfully,' which reads as if real checks were performed. No network call, bot status query, or other validation occurs in this file; the beliefs are asserted unconditionally.
- Content