Security audit

Evez Firmament

Security checks for vulnerabilities and agentic risk

Overview

This skill is a runnable microservice stack, but it exposes unauthenticated network APIs including client-controlled Python evaluation and broad mutable event/state endpoints.

Install only in an isolated development environment unless you first add authentication, bind backend ports to localhost or an internal Docker network, remove or replace the eval-based invariant engine, add input limits/rate limits, and review the Terraform targets. Do not expose these ports to a shared or public network as provided.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: services/invariance.py:60
Finding: Unauthenticated Remote Evaluation of Attacker-Controlled Python Expressions
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: services/gateway.py:35
Finding: Unauthenticated Gateway and Direct Publication of Privileged Backend APIs
Content: View full analysis
= 3: service_key = parts[2] remaining = "/" + "/".join(parts[3:]) if len(parts) > 3 else "/" code, data = self._proxy(service_key, remaining) self._send_json(code, data) ``` ```python if path.startswith("/v1/"): parts = path.split("/") if len(parts) >= 3: service_key = parts[2] remaining = "/" + "/".join(parts[3:]) if len(parts) > 3 else "/" code, data = self._proxy(service_key, remaining, method="POST", body=body) self._send_json(code, data) ``` ```python port = int(os.environ.get("GATEWAY_PORT", 9118)) server = HTTPServer(("0.0.0.0", port), GatewayHandler) ``` Representative direct backend publication: ```yaml services: invariance: build: . command: python3 /app/invariance.py ports: - "9115:9115" hostname: invariance ``` ### Technical Analysis The gateway documentation claims authentication and rate limiting, but n ...[truncated 1920 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: services/daw_agent.py:80
Finding: Unbounded BPM Input Allows Remote CPU and Memory Exhaustion
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: services/machine_voice.py:73
Finding: Unbounded Voice Sessions and Formant Parameters Permit Memory Exhaustion
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: services/event_spine.py:110
Finding: Event Spine Allows Unauthenticated Event Injection and Record Disclosure
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: services/Dockerfile:1
Finding: Unpinned Build Dependencies and Root Container Execution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (59)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · Makefile (reported line 39)May include surrounding context.
text
status: @echo "═══ EVEZ-OS FULL STATUS ═══" @curl -sf http://localhost:9117/status 2>/dev/null | python3 -m json.tool || echo "Mesh health not available" @echo "" @curl -sf http://localhost:9116/status 2>/dev/null | python3 -m json.tool || echo "Event spine not available"

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · Makefile (reported line 41)May include surrounding context.
text
@echo "═══ EVEZ-OS FULL STATUS ═══" @curl -sf http://localhost:9117/status 2>/dev/null | python3 -m json.tool || echo "Mesh health not available" @echo "" @curl -sf http://localhost:9116/status 2>/dev/null | python3 -m json.tool || echo "Event spine not available" # Individual service control consciousness:

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · Makefile (reported line 45)May include surrounding context.
text
# Individual service control consciousness: @curl -sf http://localhost:9111/state | python3 -m json.tool dream: @curl -sf -X POST http://localhost:9111/dream | python3 -m json.tool

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · Makefile (reported line 48)May include surrounding context.
text
@curl -sf http://localhost:9111/state | python3 -m json.tool dream: @curl -sf -X POST http://localhost:9111/dream | python3 -m json.tool synthesize: @curl -sf -X POST "http://localhost:9112/synthesize?bpm=170&style=breakcore" | python3 -m json.tool

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · Makefile (reported line 51)May include surrounding context.
text
@curl -sf -X POST http://localhost:9111/dream | python3 -m json.tool synthesize: @curl -sf -X POST "http://localhost:9112/synthesize?bpm=170&style=breakcore" | python3 -m json.tool voice-transform: @curl -sf -X POST "http://localhost:9113/transform?stage=5" | python3 -m json.tool

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · Makefile (reported line 54)May include surrounding context.
text
@curl -sf -X POST "http://localhost:9112/synthesize?bpm=170&style=breakcore" | python3 -m json.tool voice-transform: @curl -sf -X POST "http://localhost:9113/transform?stage=5" | python3 -m json.tool correlate: @curl -sf -X POST "http://localhost:9114/correlate" -H "Content-Type: application/json" -d '{"domain_a":"physics","domain_b":"economics"}' | python3 -m json.tool

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · Makefile (reported line 57)May include surrounding context.
text
@curl -sf -X POST "http://localhost:9113/transform?stage=5" | python3 -m json.tool correlate: @curl -sf -X POST "http://localhost:9114/correlate" -H "Content-Type: application/json" -d '{"domain_a":"physics","domain_b":"economics"}' | python3 -m json.tool falsify: @curl -sf -X POST "http://localhost:9115/falsify" | python3 -m json.tool

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · Makefile (reported line 60)May include surrounding context.
text
@curl -sf -X POST "http://localhost:9114/correlate" -H "Content-Type: application/json" -d '{"domain_a":"physics","domain_b":"economics"}' | python3 -m json.tool falsify: @curl -sf -X POST "http://localhost:9115/falsify" | python3 -m json.tool spine: @curl -sf http://localhost:9116/status | python3 -m json.tool

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · Makefile (reported line 63)May include surrounding context.
text
@curl -sf -X POST "http://localhost:9115/falsify" | python3 -m json.tool spine: @curl -sf http://localhost:9116/status | python3 -m json.tool replay: @curl -sf "http://localhost:9116/replay?domain=consciousness" | python3 -m json.tool

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · Makefile (reported line 66)May include surrounding context.
text
@curl -sf http://localhost:9116/status | python3 -m json.tool replay: @curl -sf "http://localhost:9116/replay?domain=consciousness" | python3 -m json.tool # RQNS pipeline rqns:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · services/Makefile (reported line 36)May include surrounding context.
text
$(eval NAME=$(word 1,$(subst :, ,$(svc)))) \ if [ -f $(PIDS_DIR)/$(NAME).pid ]; then \ kill `cat $(PIDS_DIR)/$(NAME).pid` 2>/dev/null && echo " Stopped $(NAME)" || true; \ rm -f $(PIDS_DIR)/$(NAME).pid; \ fi; \ ) @echo "Mesh stopped."

eval() call detected

High

Category: Dangerous Code Execution
Confidence: 99% confidence
Finding: This is a true code-execution risk. Although the eval environment tries to restrict builtins, untrusted Python expressions are still being executed from the /assert API, which is attacker-controlled input; Python sandboxing via eval is brittle and can often be escaped or abused for denial of service through expensive expressions. In this service context, invariant expressions are a core feature, so the dangerous part is that arbitrary clients can submit executable expressions that are later run against service state.
Content: Scanner excerpt · services/invariance.py (reported line 71)May include surrounding context.
python
"None": None, "round": round, }} safe_globals["state"] = state result = eval(expression, safe_globals, {}) return bool(result), None except Exception as e: return False, str(e)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · Makefile (reported line 57)May include surrounding context.
text
@curl -sf -X POST "http://localhost:9113/transform?stage=5" | python3 -m json.tool correlate: @curl -sf -X POST "http://localhost:9114/correlate" -H "Content-Type: application/json" -d '{"domain_a":"physics","domain_b":"economics"}' | python3 -m json.tool falsify: @curl -sf -X POST "http://localhost:9115/falsify" | python3 -m json.tool

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · Makefile (reported line 86)May include surrounding context.
text
# Security audit: @echo "═══ SECURITY AUDIT ═══" @sudo fail2ban-client status sshd 2>/dev/null | head -5 @sudo ufw status | head -10 @echo "Open ports:" @ss -tlnp | grep LISTEN | awk '{print " " $$4}'

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · Makefile (reported line 87)May include surrounding context.
text
# Security audit: @echo "═══ SECURITY AUDIT ═══" @sudo fail2ban-client status sshd 2>/dev/null | head -5 @sudo ufw status | head -10 @echo "Open ports:" @ss -tlnp | grep LISTEN | awk '{print " " $$4}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The terraform-destroy target invokes infrastructure teardown with -auto-approve, allowing irreversible destruction to proceed without any interactive confirmation or guardrail. In a Makefile intended for convenient operator use, this increases the chance of accidental or scripted misuse leading to loss of cloud resources, downtime, and possible data destruction.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 96% confidence
Finding: Using terraform destroy -auto-approve enables autonomous destructive execution with no human verification at the point of action. If triggered unintentionally, by automation, or by a compromised workflow, it can rapidly delete infrastructure and associated stateful resources.
Content: Scanner excerpt · Makefile (reported line 99)May include surrounding context.
text
@cd terraform && terraform apply evez-firmament.tfplan terraform-destroy: @cd terraform && terraform destroy -auto-approve

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: requests.post(SPINE_URL, json=...) transmits internal state and request-derived data to another service, creating an external communication path from this component. Even though the destination is localhost, this is still a separate trust boundary; if the receiving service is compromised, misconfigured, or persists logs insecurely, user data and internal state can be exposed.
Content: Scanner excerpt · services/consciousness_engine.py (reported line 44)May include surrounding context.
python
def spine_log(domain, action, data): try: requests.post(SPINE_URL, json={ "domain": domain, "action": action, "data": data,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The service forwards runtime data to another local service via spine_log, and that data includes content derived from incoming requests, such as the /pipeline input and /system/SENSE body. There is no consent, minimization, sanitization, or disclosure mechanism, so sensitive user-supplied data may be propagated beyond the original service boundary and exposed to additional logging, retention, or compromise risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The service automatically transmits observation and hypothesis metadata to another local HTTP service without any user-facing disclosure, consent, or configuration gate. Even though the destination is localhost, the transmitted data may still contain sensitive operational or user-supplied content, and silent forwarding increases privacy and data-governance risk in multi-service environments.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The code sends structured runtime data to an external service via HTTP using requests.post, with no authentication, encryption, validation of the receiver, or restriction on what may be included in the payload. In this skill context, observations and hypothesis results are derived from inbound request bodies, so untrusted client-supplied data can be exfiltrated or exposed to any local process able to intercept or impersonate the logging endpoint.
Content: Scanner excerpt · services/cross_domain.py (reported line 16)May include surrounding context.
python
def spine_log(domain, action, data): try: requests.post(SPINE_URL, json={"domain": domain, "action": action, "data": data, "timestamp": time.time()}, timeout=2) except Exception: pass

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The agent transmits request-derived parameters to another local HTTP service via spine_log without any user disclosure, consent mechanism, or configuration to disable telemetry. Even though the payload appears limited to music-generation parameters and targets localhost, it still creates an undisclosed data flow that can expose user activity or become sensitive if the receiving service forwards, stores, or correlates requests.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The code performs an outbound HTTP POST to http://localhost:9116/append containing request context, creating an external transmission path from the service to another process. While localhost limits remote exfiltration, this is still a true data-transmission behavior and can leak usage data to any local service bound to that port, especially on shared hosts or if the downstream service is compromised.
Content: Scanner excerpt · services/daw_agent.py (reported line 17)May include surrounding context.
python
def spine_log(domain, action, data): try: requests.post(SPINE_URL, json={"domain": domain, "action": action, "data": data, "timestamp": time.time()}, timeout=2) except Exception: pass

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The service exposes append, project, replay, status, verify, and recent-event endpoints over plain HTTP on 0.0.0.0:9116 with no authentication, authorization, or transport protection. If event data contains sensitive operational or user information, any reachable party on the network can read it in transit or query stored records directly, making unintended disclosure likely.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The gateway advertises authentication, rate limiting, and event logging, but the implementation exposes unauthenticated proxy routes with permissive CORS and no throttling or audit trail. This is dangerous because operators or downstream users may rely on stated protections that do not actually exist, leaving internal microservices directly reachable through a public entry point and making abuse or incident response much harder.
Content: No source excerpt is available for this finding.