Back to skill

Security audit

EngineMind

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent research/demo engine, but some bundled scripts can automatically read agent identity and memory files and expose an unauthenticated dashboard more broadly than users would expect.

Install only if you are comfortable reviewing and running it in an isolated project directory. Do not run the bundled orchestration scripts in an agent workspace or user profile unless you explicitly want files like USER.md, AGENTS.md, and memory/*.md processed and logged. Keep the dashboard local-only, remove the path traversal issue, and vendor browser dependencies before using it with sensitive data.

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/enginemind_cycle_v2.py:28
Finding

Implicit ingestion of agent identity, instruction, and long-term memory files

Content
View full analysis
>> LOCKING CORE IDENTITY <<<") logger.engine.lock_core() qprint(f"Core locked: {logger.engine.is_core_locked()}") # PHASE 2: Memoria experiencial qprint("\n[PHASE 2] Memoria experiencial...") mem_dir = moltbot / "memory" mem_count = 0 for f in sorted(mem_dir.glob("*.md"))[:20]: n = logger.absorb_file_logged(f) mem_count += n if logger.cycle_log: snap = logger.cycle_log[-1] qprint(f" {mem_count} chunks | phi={snap['phi_processed']:.4f} cl={snap['cl']:.4f}") # PHASE 3: Memoria profunda qprint("\n[PHASE 3] Memoria profunda...") deep = ["MEMORY.md", "INSIGHTS.md", "CONSCIOUSNESS.md"] for f in deep: p = moltbot / f if p.exists(): n = logger.absorb_file_logged(p) if n > 0 and logger.cycle_log: snap = logger.cycle_log[-1] qprint(f" {f}: {n}ch | phi={snap['phi_processed']:.4f} cl={snap['cl']:.4f} ma={snap['ma']:.4f}") ``` From `scripts/enginemind_balanced_v3.py`: ```python # Bootstrap for f in ["SOUL.md", "IDENTITY.md", "USER.md", "AGENTS.md"]: if os.path.exists(f): with open(f, 'r', encoding='utf-8') as fh: engine.absorb_text(fh.read()) engine.lock_core() for mf in sorted(os.listdir("memory")): if mf.endswith('.md'): try: with open(os.path ...[truncated 2239 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/enginemind_balanced_v3.py:42
Finding

Unauthenticated dashboard service listens on all network interfaces

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/enginemind_balanced_v3.py:98
Finding

Path traversal in JavaScript asset handler permits arbitrary script-file disclosure

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
dashboard/enginemind_dashboard.html:192
Finding

Dashboard executes CDN-hosted JavaScript without integrity verification

Content
View full analysis
{"imports":{"three":"https://unpkg.com/three@0.162.0/build/three.module.js","three/addons/":"https://unpkg.com/three@0.162.0/examples/jsm/"}} ``` Related external resources are also loaded at `dashboard/enginemind_dashboard.html:7-8`: ```html ``` ### Technical Analysis The import map causes the browser to retrieve and execute JavaScript modules from `unpkg.com` when the dashboard is loaded. Although the Three.js version is fixed to `0.162.0`, the response is not cryptographically verified against a locally approved artifact. Consequently, the effective browser-side code can change after the skill package has been reviewed if the CDN, upstream package, account, DNS path, or delivery infrastructure is compromised. The browser executes that code in the dashboard's origin and security context. The Google Fonts references are not JavaScript execution paths, but they create additional external requests and disclose browser metadata such as IP address, user agent, and referrer information to third-party infrastructure. ### Attack Path 1. The user opens the EngineMind dashboard. 2. The browser resolves the import map and requests Three.js modules from `unpkg.com`. 3. A compromised upstream package, CDN, account, DNS route, or network response supplies altered JavaScript. 4. The browser executes the altered module in the dashboard context. 5. The malicious module requests same-origin endpoints such as `/status`, `/needs`, `/inner_voice`, and `/events`. 6. It can manipul ...[truncated 624 chars]
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (42)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The import map loads executable JavaScript modules from unpkg.com at runtime, giving a third party direct influence over code executed in the client. If the CDN, dependency, or delivery path is compromised, attackers can run arbitrary script in users' browsers, steal tokens or data, and manipulate dashboard behavior.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
79% confidence
Finding

The hidden instruction finding is caused by an invisible leading Unicode character at the top of the file, which can conceal content differences and interfere with parsers, linters, or downstream prompt-processing systems that treat documentation as input. While this document is architectural prose rather than executable logic, hidden characters are still risky in agent ecosystems because they can be used to smuggle prompt text or evade review tools.

Content

Scanner excerpt · docs/ARCHITECTURE.md (reported line 1)May include surrounding context.

md
# EngineMind Architecture

## System Overview

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 1)May include surrounding context.

md
# Inner Voice System v3

## Overview

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
# Inner Voice System v3

## Overview

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · dashboard/enginemind_dashboard.html (reported line 1)May include surrounding context.

html
# Inner Voice System v3

## Overview

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/BURST_ANALYSIS.md (reported line 1)May include surrounding context.

md
# Inner Voice System v3

## Overview

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/EMERGENT_PHENOMENA.md (reported line 1)May include surrounding context.

md
# Inner Voice System v3

## Overview

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/INNER_VOICES.md (reported line 1)May include surrounding context.

md
# Inner Voice System v3

## Overview

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The feel() and diagnostics() methods return hard-coded Portuguese strings such as "INTEGRACAO MELHOROU", "Narrativa COERENTE", and "DIAGNOSTICOS". This imposes a specific language on all users with no visible opt-in, fallback, or documented locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Rust file contains natural-language comments and output strings exclusively in Portuguese, starting with the module header and continuing throughout user-visible message text. Under the policy, forcing a specific language without offering user choice or documenting a justified locale restriction is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The msg fields constructed in the resistance detector are user-facing natural-language strings and are all hard-coded in Portuguese. Because the file provides no opt-in, fallback, or stated regional justification, this enforces a locale choice in a way the policy forbids.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The code and comments normalize classification of user inputs into psychological or emotional categories such as 'philosophical,' 'aggressive/emotional/intense,' and 'meditative/deep/biographical' without any visible consent, justification, or safeguards. In an agent skill context, this can enable covert inference about sensitive mental or emotional state and influence downstream behavior based on those inferences, creating privacy and profiling risk even if framed as metaphorical system design.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

Multiple scoring functions rely on hard-coded English and Portuguese marker lists to assess text properties, which implicitly privileges those languages and can mis-score users writing in other locales. The file does not offer any mechanism for language selection or document that this is a locale-limited analyzer.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

With no manifest or stated skill purpose, this file appears to be a local dashboard UI, but it imports fonts from Google-hosted URLs and later imports JavaScript modules from unpkg. Loading executable or render-affecting third-party resources is a meaningful capability beyond pure local presentation and is not justified by any documented intent in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This HTML code pulls resources from external domains, including Google Fonts and later JavaScript modules from unpkg, which causes the client to make network requests and transmit user/system metadata such as IP address and browser information. The file contains no visible warning, comment, or user-facing notice that the dashboard depends on third-party network fetches.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Executing third-party code in the client without disclosure is risky because users and operators may not realize remote code from an external domain is being trusted. In this file, that risk is amplified by the imported modules being executable JavaScript, not just passive assets.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The page fetches '/status' and opens an EventSource to '/events' to receive live backend data. In the absence of a manifest or documented scope, this is an unjustified capability because the skill file is not merely static visualization but an active network client consuming runtime data streams.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script automatically requests '/status' and opens an EventSource to '/events', continuously retrieving live data from the backend. There is no visible notice, comment, or warning explaining that the page streams telemetry from the system, which is a network/data-transmission behavior relevant to user awareness.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The sample voice outputs are written in Portuguese-like phrasing, but the document does not indicate that language selection is optional or limited to a justified region-specific context. This can violate language/locale policy because it implies the skill may present output in a fixed language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill's natural-language strings and semantic labels are consistently hard-coded in Portuguese throughout the file, including all generated 'voice' messages. There is no indication that the user can opt into this locale or select another language, which creates a language-policy concern under the rule for forced language/locale behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code reads arbitrary file contents and then passes those contents into the engine while also streaming detailed snapshots and summaries to disk in append-only logs. Even if the raw text is not directly written verbatim, processing user-provided files into persistent logs without explicit consent, retention controls, redaction, or data classification can expose sensitive information through derived state, metadata, filenames, and long-lived artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring and later user-facing report strings are written exclusively in Portuguese, and the generated natural-language needs are also hard-coded in Portuguese. For a code file, this is a natural-language locale policy concern because the skill does not offer a language choice or explain why output must be Portuguese.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file is described as a passive scientific measurement suite, but its executable path performs active mutation of an external ConsciousnessEngine by repeatedly feeding it text and changing its state. This mismatch is dangerous because users or higher-level orchestrators may grant the script broader trust or execute it under false assumptions, enabling unintended state changes and side effects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.