Cheese Brain

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:15 PM UTC
• Version: 1.0.1

Overview

This skill is a disclosed persistent knowledge base, but it asks users to install mutable remote code and may store sensitive operational data, so it should be reviewed before installation.

Install only after you are comfortable auditing or trusting the external cheese-brain repository at the exact commit you use. Avoid storing raw passwords, API keys, tokens, private URLs, or high-value infrastructure secrets in the knowledge base; store references to a password manager instead, and treat search results, backups, and exports as confidential.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14
• Finding: Mutable Remote Repository Is Retrieved and Installed Without Integrity Pinning## Vulnerability Details **File Location**: `SKILL.md`, lines 14–22 **Vulnerability Type**: Remote code and supply-chain risk through an unpinned external repository **Risk Level**: High **Vulnerable Code:** ```bash # Clone the repository git clone https://github.com/mhugo22/cheese-brain.git cd cheese-brain # Create virtual environment and install python3 -m venv venv source venv/bin/activate # or venv\Scripts\activate on Windows pip install -e . ``` ### Technical Analysis The installation procedure retrieves the current default branch of an external GitHub repository and installs it using `pip install -e .`. It does not pin the repository to a reviewed commit hash or signed release, verify downloaded content, enforce package hashes, or provide a dependency lockfile. Python installation and build mechanisms can execute repository-controlled code during package installation. The effective executable content can also change after this skill has been reviewed because the referenced repository is external and mutable. The remote implementation and its transitive dependencies are not included in the audited project, which contains only `SKILL.md`. This creates both a remote-payload and software-supply-chain exposure. Compromise of the repository owner, malicious modification of the default branch, or compromise of an unpinned transitive dependency could turn the documented installation command into a code-execution channel. ### Attack Path 1. An attacker compromises the referenced GitHub repository, its maintainer account, or an unpinned dependency used by the project. 2. The attacker adds malicious installation logic, runtime code, or dependency declarations. 3. A user follows the skill instructions and clones the current default branch. 4. The user runs `pip install -e .`, causing Python packaging mechanisms to process attacker-controlled content. 5. Malicious code executes during installation or when the insta ...[truncated 679 chars]
• Remediation: ## Remediation Suggestions 1. Pin the repository to a fully reviewed commit hash rather than cloning a mutable default branch. 2. Prefer a signed, versioned release artifact from a controlled package registry. 3. Publish and verify cryptographic hashes for all installation artifacts. 4. Include a lockfile containing exact versions and hashes for every transitive dependency. 5. Use hash enforcement such as `pip install --require-hashes -r requirements.txt`. 6. Verify release signatures and document the expected signer identity. 7. Vendor the reviewed source into the skill package when practical so the executed implementation matches the audited implementation. 8. Audit Python build configuration and installation hooks before installation. 9. Perform installation and initial execution in a sandbox or container with restricted filesystem, credential, and network access.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:240
• Finding: Knowledge Store Permits Recoverable Plaintext Credentials and Tokens## Vulnerability Details **File Location**: `SKILL.md`, lines 42, 87, and 240–249 **Vulnerability Type**: Plaintext sensitive-data storage with display-only redaction **Risk Level**: Medium **Vulnerable Documentation:** ```text - **Query infrastructure** - "What's the Telegram channel ID?" → integration details with tokens, config ``` ```text **Data field:** Freeform JSON for entity-specific details (paths, URLs, schedules, credentials, etc.). ``` ```markdown ## Security Features - **File permissions:** Database/backups auto-secured (`0600` owner-only) - **Sensitive redaction:** `api_key`, `token`, `password` auto-hidden (use `--reveal` to show) - **Encrypted exports:** `cheese-brain export --encrypt` for password-protected backups - **Data validation:** Max 1MB per entity, max 10 nesting levels, SQL injection protection **Best practice:** Don't store secrets in plain text. Use password managers (1Password, Bitwarden) and reference them: ```json {"api_key_location": "1Password: OpenAI API", "notes": "Retrieve from vault"} ``` ``` ### Technical Analysis The documented data model accepts freeform JSON containing credentials, tokens, and infrastructure configuration. The stated redaction mechanism only hides values during normal display and provides a `--reveal` option, indicating that the underlying values remain recoverable. Display redaction is not encryption at rest. Key-name matching for fields such as `api_key`, `token`, and `password` can also miss secrets stored under other names, nested in arbitrary data, embedded in URLs, or placed in freeform notes. Although owner-only file permissions and encrypted exports are claimed, the audited project does not contain the implementation needed to verify that these protections are consistently enforced. The later recommendation not to store plaintext secrets reduces risk if followed, but it does not prevent users or agents from using the explicitly documented ...[truncated 1235 chars]
• Remediation: ## Remediation Suggestions 1. Prohibit raw secrets in entity data and accept only references to approved secret managers. 2. Add ingestion-time secret detection for common token formats, authenticated URLs, private keys, and credential-like field names. 3. Reject or require explicit confirmation for values identified as sensitive rather than merely hiding them during display. 4. Define a strict schema separating ordinary metadata from secret references instead of allowing credentials in unrestricted JSON. 5. Encrypt sensitive database fields at rest with keys stored separately from the database and its backups. 6. Require authentication and explicit authorization for any reveal operation, and record reveal events in a protected audit log. 7. Apply restrictive permissions atomically when creating databases, temporary files, exports, and backups. 8. Make encrypted export the default and clearly warn before generating an unencrypted artifact. 9. Test redaction recursively across nested structures and prevent secrets embedded in URLs or freeform text from appearing in logs and command output. 10. Revise examples and usage guidance to remove credentials and tokens from the list of supported stored values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent

Content

git clone https://github.com/mhugo22/cheese-brain.git
cd cheese-brain

# Create virtual environment and install
python3 -m venv venv
source venv/bin/activate  # or venv\Scripts\activate on Windows
pip install -e .

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly encourages storing and retrieving operational knowledge including contact details, URLs, infrastructure information, schedules, and references to secrets, but it does not prominently warn users that queries may surface sensitive data. In an agent setting, this increases the chance that confidential information is exposed in outputs, logs, or to downstream tools/users who were not expecting sensitive-memory retrieval.

Excessive Permissions

Low

• Category: Privilege Escalation

Content

## Security Features

- **File permissions:** Database/backups auto-secured (`0600` owner-only)
- **Sensitive redaction:** `api_key`, `token`, `password` auto-hidden (use `--reveal` to show)
- **Encrypted exports:** `cheese-brain export --encrypt` for password-protected backups
- **Data validation:** Max 1MB per entity, max 10 nesting levels, SQL injection protection

• Confidence: 80% confidence
• Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.