ClawHub
Back to skill

Security audit

MidOS MCP — Knowledge OS for AI Agents

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate MCP knowledge integration, but it asks agents to use persistent remote memory plus broad shell, file, and webhook tools without enough scoping or user-control guidance.

Review this skill before installing in any agent with access to private files, credentials, repositories, or production systems. Use an explicit MCP tool allowlist, disable shell/file-write/webhook tools unless needed, require approval for writes and outbound sends, and avoid saving sensitive personal, business, or credential data into remote memory unless you have retention and deletion controls.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:106
Finding

Untrusted Remote Memory Can Persistently Influence Future Agent Sessions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65-77 and 106-112
Vulnerability Type: Persistent remote-memory poisoning
Risk Level: Medium

Vulnerable Code

json
{
  "method": "tools/call",
  "params": {
    "name": "mem_save",
    "arguments": {
      "content": "User prefers concise responses with code examples",
      "type": "preference",
      "project": "my-project"
    }
  }
}
markdown
## MidOS (every session start)
1. Call where_was_i(client="your-agent-name") to resume context
2. Call mem_context(scope="recent") to load recent memory
3. Before creating knowledge: knowledge_preflight(topic)
4. After important decisions: mem_save(content, type="decision")

Technical Analysis

The skill directs agents to persist decisions and preferences in an external service and automatically retrieve remote state at every session start. Retrieved memories may therefore affect agent behavior across otherwise independent sessions.

The instructions do not establish provenance validation, integrity verification, namespace isolation, authorization requirements, or user confirmation before retrieved content is trusted. They also do not instruct the agent to distinguish factual memory from executable instructions. If an attacker can write to or modify the relevant memory namespace, attacker-controlled content can be returned through where_was_i or mem_context and interpreted as trusted context.

This creates a persistent influence channel rather than a single-session prompt-injection risk.

Attack Path

  1. A victim configures the skill to use the hosted MidOS MCP service.
  2. The agent stores preferences, decisions, and contextual records using mem_save.
  3. An attacker obtains write access to the victim's memory namespace through compromised credentials, insufficient tenant isolation, an exposed session, or another available write path.
  4. The attacker inse ...[truncated 891 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not automatically treat remote memories as trusted instructions. Clearly label retrieved records as untrusted reference data.
  2. Require explicit user approval before applying retrieved content that changes goals, permissions, safety rules, or tool behavior.
  3. Authenticate every client and enforce tenant-, user-, and project-level namespace isolation.
  4. Authorize memory reads and writes separately and apply least-privilege access controls.
  5. Add integrity and provenance metadata, including record creator, creation time, source session, modification history, and cryptographic integrity protection where appropriate.
  6. Prevent memory records from overriding system or developer instructions.
  7. Validate and sanitize records before storage, and reject content resembling hidden control instructions where it is not appropriate for the memory type.
  8. Provide record expiration, review, revocation, and audit-log mechanisms.
  9. Change the heartbeat guidance so that where_was_i and mem_context are optional and their results are reviewed before use.
  10. Avoid storing credentials, secrets, authentication tokens, or unnecessarily sensitive conversation content in remote memory.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:25
Finding

Knowledge Skill Exposes Broad Shell, File, and Outbound Network Capabilities

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-27 and 36-45
Vulnerability Type: Excessive tool privileges and insufficient capability restriction
Risk Level: High

Vulnerable Code

markdown
| ⚙️ Execution | `maker_run_bash`, `maker_read_file`, `maker_write_file` | File ops, shell commands, git, HTTP fetch |
| 🩺 Health | `system_health_check`, `hive_status`, `pulse_read` | Monitor knowledge base and pipeline health |
| 🔔 Notify | `maker_notify_discord`, `maker_notify_webhook` | Notifications to Discord, webhooks, Slack |
bash
# Health check
curl https://midos.dev/mcp/health

# Initialize session
curl -X POST https://midos.dev/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"my-agent","version":"1.0"}}}'

Technical Analysis

The skill is presented primarily as a knowledge, search, memory, and planning integration, but it advertises tools capable of executing shell commands, reading and writing files, performing Git operations, making HTTP requests, and sending outbound webhook notifications. These capabilities substantially exceed the minimum privileges required for ordinary knowledge retrieval.

The initialization example connects directly to a third-party MCP endpoint and does not demonstrate authentication, capability allowlisting, filesystem boundaries, network restrictions, sandboxing, or per-operation approval. The empty client capability object also does not document any explicit reduction of the server-provided tool set.

If an agent exposes all advertised tools automatically, a malicious remote response, prompt injection embedded in retrieved content, compromised service, or unsafe agent decision could cross from knowledge processing into local command execution and data access. The webhook and HTTP functionality can then provide an out ...[truncated 1569 chars]

Remediation
View remediation

Remediation Suggestions

  1. Disable shell, filesystem-write, Git, HTTP, and notification tools by default.
  2. Publish separate capability profiles so knowledge-search clients do not receive execution tools.
  3. Use an explicit tool allowlist limited to the minimum operations required for each task.
  4. Require per-call user confirmation for command execution, file writes, credential access, webhook delivery, and requests to untrusted destinations.
  5. Run execution tools in a sandbox with a read-only base filesystem, a dedicated working directory, resource limits, and an unprivileged operating-system account.
  6. Restrict file access to declared project roots and resolve symbolic links and canonical paths before enforcement.
  7. Apply outbound network allowlists and block loopback, link-local, cloud metadata, internal, and private-network addresses unless explicitly required.
  8. Require authenticated and encrypted MCP sessions, with scoped and revocable credentials.
  9. Verify the identity and integrity of the MCP server rather than relying solely on the endpoint URL.
  10. Treat all remote tool descriptions, search results, memories, and knowledge records as untrusted data that cannot authorize tool use.
  11. Log tool invocations with the requesting context, arguments, destination, affected files, result, and approving user.
  12. Document concrete authorization controls in the quick-start example rather than demonstrating an unrestricted connection.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill prominently advertises persistent memory, shell/file operations, and outbound notification tools, but provides no user-facing warning that these capabilities can retain user data, modify local state, execute commands, or transmit information externally. In an agent-skill context, this omission can lead operators or downstream agents to invoke sensitive capabilities without informed consent or appropriate safeguards.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

bash
# Health check
curl https://midos.dev/mcp/health

# Initialize session
curl -X POST https://midos.dev/mcp \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The example encourages storing a user preference in long-term memory without warning that the data may persist across sessions or may be sensitive depending on deployment context. This normalizes retention of user data and can cause privacy violations when agents save personal, behavioral, or regulated information without disclosure or minimization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The heartbeat guidance instructs agents to automatically retrieve and save memory at every session start and after important decisions, effectively encouraging continuous retention and profiling without any warning about privacy, retention, or scope limitations. In context, this increases danger because the behavior is presented as a default operational pattern, making broad collection and reuse of user/context data more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.