Cortex

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:29 AM UTC
• Version: 4.0.0

Overview

Cortex is a coherent memory skill, but it warrants review because installation and sync guidance can run unverified code and persist broad sensitive data.

Review this before installing. Prefer Homebrew or a pinned, verified release rather than running scripts/setup.sh as-is. Do not enable connector sync-all, scheduled sync, third-party LLM enrichment, or local HTTP/SSE serving until you have scoped sources, reviewed what data may be imported, and decided where the SQLite database should live. Treat reimport as destructive and avoid setting CORTEX_DB to anything outside the Cortex data directory.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup.sh:38
• Finding: Unverified Remote Binary Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh`, lines 5 and 38-52 **Vulnerability Type**: Remote payload retrieval and execution without integrity verification **Risk Level**: High ### Vulnerable Code ```bash CORTEX_VERSION="${CORTEX_VERSION:-latest}" ``` ```bash # Download binary if [[ "$CORTEX_VERSION" == "latest" ]]; then DOWNLOAD_URL="https://github.com/$REPO/releases/latest/download/cortex-${OS}-${ARCH}" else DOWNLOAD_URL="https://github.com/$REPO/releases/download/$CORTEX_VERSION/cortex-${OS}-${ARCH}" fi echo " Downloading: $DOWNLOAD_URL" if command -v curl &>/dev/null; then curl -fSL "$DOWNLOAD_URL" -o "$INSTALL_DIR/cortex" 2>/dev/null elif command -v wget &>/dev/null; then wget -q "$DOWNLOAD_URL" -O "$INSTALL_DIR/cortex" else echo "ERROR: Need curl or wget" >&2; exit 1 fi chmod +x "$INSTALL_DIR/cortex" # Verify VERSION="$("$INSTALL_DIR/cortex" version 2>/dev/null || echo "FAILED")" ``` ### Technical Analysis The setup script downloads a precompiled executable from a remote GitHub release, marks it executable, and immediately runs it. It does not verify a cryptographic checksum or a release signature. The default version selector is `latest`, which is a mutable reference. Consequently, the effective code executed by the Skill can change after the Skill package itself has been reviewed. The existing “Verify” step only checks whether the downloaded program can execute and return a version; it does not establish authenticity or integrity. HTTPS protects the transfer in transit but does not protect against compromise of the upstream repository, maintainer account, release workflow, or published release artifact. This behavior exceeds the minimum safe privilege necessary for installation because arbitrary remote code is trusted and executed without independent validation. ### Attack Path 1. An attacker compromises the upstream GitHub repository, maintainer credentials, release automation, or release art ...[truncated 1074 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the mutable `latest` default with a specifically pinned, reviewed release version. 2. Publish a SHA-256 or stronger digest for every supported platform artifact and pin the expected digest in trusted Skill code. 3. Download the binary to a newly created temporary file rather than directly overwriting the installed executable. 4. Verify the digest before applying executable permissions or invoking the binary. 5. Prefer signed release artifacts and validate signatures against a pinned maintainer public key. 6. Abort installation on every verification failure and remove the temporary artifact. 7. Atomically move the verified artifact into the installation directory. 8. Avoid suppressing download diagnostics that would be useful for identifying redirects or verification failures. 9. Consider building from a pinned source commit in a controlled build environment when reproducible builds are available. A hardened installation flow should follow this order: ```text Pin version and digest → download to a secure temporary file → verify checksum and signature → set permissions → atomically install → execute only the verified artifact ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cortex-wrapper.sh:42
• Finding: Arbitrary User-Writable File Deletion Through CORTEX_DB<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cortex-wrapper.sh`, lines 42-45 **Vulnerability Type**: Unrestricted file deletion through an environment-controlled path **Risk Level**: Medium ### Vulnerable Code ```bash reimport) echo "Full re-import from workspace memory..." DB="${CORTEX_DB:-$HOME/.cortex/cortex.db}" rm -f "$DB" ``` ### Technical Analysis The `reimport` operation assigns the deletion target directly from the `CORTEX_DB` environment variable and passes it to `rm -f` without validating that the path identifies a legitimate Cortex database. Shell quoting prevents argument splitting and conventional shell metacharacter injection, but it does not constrain which file may be deleted. An absolute path, relative path, or symbolic-link path can identify any file writable by the invoking user. The operation does not confirm that the target is a regular database file, resides under an approved Cortex data directory, or has the expected filename. Deleting the Cortex database is functionally relevant to a full re-import, but allowing an unrestricted environment variable to select the deletion target exceeds the minimum privilege necessary for that operation. ### Attack Path 1. An attacker, compromised parent process, automation environment, or user configuration controls the `CORTEX_DB` environment variable. 2. `CORTEX_DB` is set to a valuable file writable by the victim, such as a shell configuration file, agent state file, or application database. 3. The victim or automated agent invokes: ```bash scripts/cortex-wrapper.sh reimport ``` 4. The wrapper resolves `DB` to the attacker-selected path. 5. `rm -f "$DB"` deletes the selected file without validation or confirmation. 6. The wrapper proceeds with imports, potentially obscuring the destructive side effect as part of an expected maintenance operation. ### Impact Assessment Exploitation can delete any file writable by the invoking user. Potential con ...[truncated 446 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve the configured database path to a canonical absolute path before deletion. 2. Restrict deletion to a dedicated approved directory, such as `$HOME/.cortex`. 3. Require the target to be a regular file with an expected database filename or extension. 4. Reject symbolic links and paths containing traversal outside the approved directory. 5. Reject empty paths, root paths, home-directory paths, and other safety-critical locations. 6. Require explicit confirmation when a non-default database path is used. 7. Prefer a Cortex-native database reset command if one is available, avoiding direct filesystem deletion. 8. Create a backup or use a reversible rename before destructive re-import operations. 9. Clearly display the validated canonical target immediately before deletion. For example, the wrapper should verify that the canonical target is exactly the configured Cortex database beneath the canonical Cortex data directory before performing any destructive operation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill requires shell-capable support via `scripts/*` and documents executable commands, but it does not declare an explicit tool/permission scope. That creates ambiguity about what execution capabilities the skill expects and weakens least-privilege controls, increasing the chance an agent may invoke shell access more broadly than intended.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill markets itself as local-first and zero-cloud, but the same document advertises external connectors, HTTP/SSE service exposure, browser serving, and optional third-party LLM/embedding providers. This mismatch can mislead operators into granting trust or deployment latitude under incorrect assumptions, resulting in unreviewed network exposure or off-device data flows.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The connector sync features allow ingestion from broad external sources such as email, chat, code hosting, and cloud documents into persistent memory storage. For a skill framed as agent memory, that materially expands data collection scope and can pull in sensitive information unrelated to the immediate task, creating privacy, retention, and over-collection risks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The connector documentation encourages syncing external providers but does not warn that imported mail, chats, documents, and repository content may contain secrets, personal data, or regulated information that will be persisted locally. Users may unknowingly centralize sensitive data into a long-lived SQLite store accessible to the agent and related tooling.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The scheduled sync instructions automate repeated ingestion of local sessions and external-provider data without emphasizing that new sensitive content will continue to be imported over time. This increases the chance of silent data accumulation, policy drift, and retention of information the user did not intend to keep in agent memory.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The `reimport` command unconditionally deletes the Cortex SQLite database with `rm -f "$DB"` before rebuilding it, with no confirmation prompt, dry-run mode, backup, or validation of the target path. In an agent-oriented wrapper, this is risky because a user, automation, or misconfigured environment variable such as `CORTEX_DB` could trigger irreversible data loss more easily than in an interactive admin-only tool.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The setup script downloads and executes a prebuilt binary from a remote GitHub release without any integrity verification such as a pinned checksum or signature. That creates a supply-chain risk: if the release asset, repository, network path, or selected version is compromised, the user will install and run attacker-controlled code. The skill being described as local-first and zero-dependency does not justify unauthenticated remote code installation, and the subsequent execution of the downloaded binary for version verification increases exposure.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The installer persistently modifies shell startup files to prepend a user-controlled install directory to PATH. This broadens the effect of the installation beyond the current session and can increase command hijacking risk if that directory later contains unexpected binaries or is writable by less-trusted processes. In a memory tool, persistent shell-profile modification is not strictly necessary for core functionality and should be treated as a sensitive side effect requiring explicit consent.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: The manifest emphasizes a local memory layer with MCP tools, but these lines describe exposing network services on a port and serving interactive content to a browser. That is a secondary platform/server capability rather than an obvious requirement of persistent memory storage itself.

Static analysis

No suspicious patterns detected.