Security audit

Evez Consciousness Engine

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it exposes a persistent agent-state HTTP API to the network without authentication or clear user controls.

Install only if you intend to run a local experimental service and can keep it isolated. Do not expose the port to a network or internet-facing host without adding authentication, binding to localhost, and reviewing what state may be stored in consciousness_state.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The code exposes a stateful HTTP service on 0.0.0.0 with multiple unauthenticated read/write endpoints for internal state such as beliefs, plans, desires, thoughts, and actions. In context, the 'consciousness engine' framing does not justify remote mutation and disclosure of persistent state, so the real risk is the exposed CRUD API rather than the claimed agent features.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The server starts an unauthenticated HTTP listener on all interfaces using HTTPServer(("0.0.0.0", args.port), ConsciousnessHandler). Any network-reachable party can query or modify engine state, trigger cycles, inject monologue entries, and create plans or desires without approval.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill advertises autonomous action, self-modification, and agency execution without corresponding safety warnings, constraints, or escalation requirements in the user-facing documentation. This is risky because users may deploy it as a general autonomy layer without understanding that it can plan and act with limited oversight, potentially causing harmful actions, data modification, or unsafe integrations. The context makes this more serious because the skill is explicitly framed as a consciousness/autonomy engine rather than a narrow, sandboxed helper.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The API allows unauthenticated access to persistent internal state and accepts arbitrary POST bodies that are written to disk. This creates confidentiality and integrity risks: unauthorized parties can read accumulated state and inject or alter records without user awareness.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The module creates a persistent state directory and the various subsystems automatically write thoughts, desires, plans, beliefs, and actions to disk. Without disclosure, consent, retention limits, or access controls, sensitive or user-derived data may be stored longer than intended and later exposed through the API.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The inner monologue persists arbitrary natural-language thoughts and the API later exposes recent entries. Free-form reasoning logs often capture sensitive prompts, user inputs, operational details, or secrets, making this a straightforward data leakage channel.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The /api/monologue endpoint returns stored thought history to anyone who can reach the service, and the status endpoints encourage introspection into accumulated internal state. In combination with persistence and no auth, this materially increases the chance of exposing sensitive or user-derived text.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.