Security audit

PAO System

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real cross-device AI coordination tool, but its default networking and storage expose too much without authentication or clear safeguards.

Install only after reviewing the networking model. Do not run the listener or WebSocket server on an untrusted network; bind services to localhost or a trusted VPN, add real authentication/TLS, restrict file handlers to an explicit workspace, validate outbound URLs and callbacks, and avoid storing sensitive memories until encryption-at-rest is actually implemented.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: src/protocols/websocket_server.py:113
Finding: Unauthenticated WebSocket Service Exposed on All Network Interfaces
Content: View full analysis
None: connection_id = self.generate_connection_id() connection = WebSocketConnection(connection_id, websocket) create_default_message_handlers(connection) self.connections[connection_id] = connection if self.on_connection_open: try: await self.on_connection_open(connection) except Exception as e: logger.error(f"Connection-open callback failed: {e}") try: await connection.connect() await self._message_loop(connection) except ConnectionClosed: logger.info(f"Connection closed normally: {connection_id}") except Exception as e: logger.error(f"Connection handling failed: {e}") finally: await self._cleanup_connection(connection_id) ``` The security configuration declares controls that are not enforced by the server: ```python class SecurityConfig: privacy_level: PrivacyLevel = PrivacyLevel.STANDARD encrypti ...[truncated 2391 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: task_listener.py:109
Finding: Remote Task Parameters Permit Filesystem Reconnaissance Outside the Workspace
Content: View full analysis
Dict[str, Any]: """File search task""" pattern = task.task_params.get("pattern", "") path = task.task_params.get("path", ".") from pathlib import Path base = Path(path) results = list(base.glob(pattern))[:10] return { "pattern": pattern, "count": len(results), "files": [str(f) for f in results], "ws_id": self.ws_id } ``` ```python async def _handle_code_analysis(self, task: TaskMessage) -> Dict[str, Any]: """Code analysis task""" file_path = task.task_params.get("file_path", "") if not file_path: return {"error": "Missing file_path parameter"} try: p = Path(file_path) if p.exists(): content = p.read_text(encoding="utf-8") return { "file": file_path, "lines": len(content.split("\n")), "size": len(content), "ws_id": self.ws_id } else: return {"error": f"File does not exist: {file_path}"} except Exception as e: return {"error": str(e)} ``` ### Technical Analysis Both handlers accept caller-controlled paths without restricting them to a designated project or workspace directory. Absolute paths, parent-directory traversal, wildcard patterns, and paths reached through symbolic links are not rejected. The search operation returns matching path names. The code-analysis operation confirms whether a target exists and reads the entire file before returning its line count and size. Although it does not directly return file contents, it exposes filesystem metadata and can be used to identify credentials, source code, configuration files, user directories, and other sensitive resou ...[truncated 1846 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: task_listener.py:142
Finding: Caller-Controlled URLs Enable Server-Side Request Forgery and Arbitrary Result Callbacks
Content: View full analysis
Dict[str, Any]: """Web fetch task""" url = task.task_params.get("url", "") if not url: return {"error": "Missing URL parameter"} try: import httpx resp = httpx.get(url, timeout=30) return { "url": url, "status": resp.status_code, "length": len(resp.text), "ws_id": self.ws_id } except Exception as e: return {"error": str(e)} ``` ```python async def _send_callback(self, task: TaskMessage): """Send callback result""" callback_url = task.callback_url if not callback_url: return result_msg = { "msg_type": MessageType.TASK_RESULT.value, "task_id": task.task_id, "sender_ws": self.ws_id, "status": task.status, "result": task.result, "error": task.error, "completed_at": task.completed_at } try: import httpx if callback_url.startswith("ws://"): async with httpx.AsyncClient() as client: pass else: async with httpx.AsyncClient() as client: resp = await client.post( callback_url, json=result_msg, timeout=30 ) logger.info(f"Callback response: {resp.status_code}") except Exception as e: logger.error(f"Callback failed: {e}") ``` ### Technical Analysis The `web_fetch` handler performs an HTTP request to a URL supplied directly by a task sender. The callback mechanism similarly posts task results to a sender-controlled destination. Neither path validates the URL scheme, hostname, resolved IP address, destin ...[truncated 1889 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/core/memory.py:90
Finding: Persistent AI Memory Is Stored as Plaintext Despite Encryption-at-Rest Configuration
Content: View full analysis
None: try: memory_files = list(self.storage_path.glob("*.json")) for file_path in memory_files: try: async with aiofiles.open( file_path, "r", encoding="utf-8" ) as f: content = await f.read() data = json.loads(content) memory = MemoryItem(**data) self.memories[memory.id] = memory self._add_to_indices(memory) except Exception as e: print(f"Failed to load memory file {file_path}: {e}") except Exception as e: print(f"Failed to load memory system: {e}") ``` ```python async def save(self, memory: MemoryItem) -> None: try: memory.updated_at = time.time() ...[truncated 2270 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (207)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Heartbeat/liveness monitoring and periodic status messaging add autonomous network activity and device-state tracking beyond the visible manifest description. Continuous monitoring can leak metadata about device presence and create background communications users may not expect.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 76% confidence
Finding: This module creates and persists sensitive secrets such as encryption keys and auth tokens in a predictable plaintext YAML file under the user's home directory. Although storing application secrets is sometimes necessary, this design increases exposure to local compromise, accidental backup/sync leakage, permissive directory ACLs, or other processes reading the file, especially because only the file permissions are tightened and only on Unix.
Content: Scanner excerpt · build/lib/core/config.py (reported line 174)May include surrounding context.
python
self.config_dir = Path(config_dir) self.config_file = self.config_dir / "config.yaml" self.secrets_file = self.config_dir / "secrets.yaml" # 确保目录存在 self.config_dir.mkdir(parents=True, exist_ok=True)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code derives and stores the host MAC address, which is a stable hardware identifier, and later includes device properties in advertised service metadata. Exposing MAC addresses is particularly sensitive because it enables persistent device tracking and stronger host correlation across sessions and networks, with little justification for the assistant's stated purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code serializes local device metadata and publishes it via Zeroconf service properties to the local network. Broadcasting this information makes passive collection easy for any host on the same LAN and can expose sensitive system details useful for reconnaissance, profiling, or identifying valuable targets.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.