Security audit

MidOS Memory Cascade

Security checks for vulnerabilities and agentic risk

Overview

This skill is a memory search tool, but it also has broad persistent write and import behavior that can escape the skill package and should be reviewed before installation.

Review this skill carefully before installing. It is not just a read-only memory search helper: it can persist content, change future routing behavior, import code from paths outside the package, and write files based on caller-supplied filenames. Use only in a contained environment with a private workspace, trusted dependencies, and patched path validation; avoid passing secrets or untrusted filenames to store().

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: memory_cascade.py:48
Finding: Incorrect Trust-Root Calculation Enables Cross-Project File Access
Content: View full analysis
Remediation: View remediation
Path: base = base.resolve(strict=True) candidate = (base / relative).resolve() if candidate != base and base not in candidate.parents: raise ValueError("Path escapes the configured workspace") return candidate ``` - Avoid treating shared temporary directories as application trust roots. - Apply restrictive filesystem permissions to memory, statistics, and database directories. - Add deployment tests asserting that `ROOT`, `DB_PATH`, and `SYSTEM_DIR` remain inside the expected project workspace. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: memory_cascade.py:913
Finding: Unvalidated Filename Allows Arbitrary File Creation and Overwrite
Content: View full analysis
Remediation: View remediation
str: supplied = Path(value) if supplied.is_absolute() or supplied.name != value: raise ValueError("Only a safe filename is permitted") if value in {"", ".", ".."}: raise ValueError("Invalid filename") return value ``` - Resolve the final path and enforce directory containment before every read, write, or append: ```python def safe_destination(base: Path, filename: str) -> Path: base = base.resolve() destination = (base / validate_filename(filename)).resolve() if destination.parent != base: raise ValueError("Destination escapes the approved directory") return destination ``` - Account for symbolic links by using platform-appropriate secure file-opening mechanisms and avoiding writes through pre-existing symlinks. - Use exclusive creation where overwriting is not required. - Maintain an allowlist of file extensions appropriate for each store. - Apply length and character restrictions to filenames. - Add tests covering absolute paths, traversal paths, nested paths, Windows drive paths, UNC paths, and symlink escapes. ]]>

T08 · Insecure Dependencies

Error

Location: memory_cascade.py:48
Finding: Shared Writable Directory Precedence Enables Python Import Hijacking
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents the skill primarily as a search mechanism, but the documented behavior includes persistent writes via store(), access to JSON state files, and adaptive telemetry/evolution that changes future behavior. This mismatch is dangerous because users or orchestrators may grant or invoke the skill for read-like retrieval while it silently performs stateful writes and behavior-changing learning operations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises capabilities that include file reads, file writes, and shell/CLI execution paths, but it declares no explicit tool scope or permission boundaries. In an agent environment, this creates an authorization gap where a broadly-invoked skill may access or persist data beyond what users expect, increasing the chance of unintended filesystem access or command execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is described in broad terms as an automatic search engine without clear activation constraints, which can cause it to be selected for many unrelated prompts. In an agentic system, overbroad triggering increases the likelihood of unnecessary data access across multiple storage tiers and can expose more local state than required for the task.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Routing any query beginning with common words like how/what/why directly to semantic search is overly broad and may match ordinary conversation rather than intentional memory retrieval. This can unnecessarily send large volumes of user text into broader search tiers, increasing privacy exposure and the chance of retrieving unrelated sensitive content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The self-evolution feature changes future tier selection based on stored history, but the description does not clearly warn that behavior will drift over time. While not inherently malicious, undocumented adaptation can undermine predictability, auditing, and reproducibility, especially if historical data is skewed or poisoned.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example usage of store() presents automatic writing as a normal helper call without warning that it persists content to storage. This is dangerous because users or upstream agents may pass secrets, tokens, or sensitive conversation data into store() without realizing it will be durably written across memory backends.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The semantic search path imports an external vector-store helper and comments explicitly reference Gemini API calls, indicating queries may be transmitted off-host. In an agent memory tool, user prompts and internal context can contain sensitive data, so undisclosed external transmission creates confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Spawning an external process is a stronger capability than ordinary in-process memory lookup and is not clearly justified by the manifest's description of a memory-search skill. Although local search is expected, using subprocess execution introduces an execution capability that should be explicitly in scope if intended.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · memory_cascade.py (reported line 347)May include surrounding context.
python
pattern = ".*".join(words) try: result = subprocess.run( ["grep", "-rl", "-i", pattern, "knowledge/chunks/"], capture_output=True, text=True,

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The section header labels this tier as MCP graph memory with curated relations, which suggests a different backend and retrieval semantics. In reality, _t5_mcp_lookup only queries the local SQLite database tables quality_scores and retrieval_events using MATCH/LIKE, so the documentation materially misstates the tier's actual behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is presented primarily as a recall/search component, but it also exposes broad persistent write capability to several filesystem locations, including caller-influenced filenames. In an agent setting, that expands the trust boundary from read/search into durable state mutation, enabling unintended persistence, log planting, or data tampering if the tool is invoked on untrusted prompts or content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The store function can write attacker- or prompt-influenced content to multiple persistent locations without any confirmation, approval, or strong path controls. In an autonomous agent context, this enables durable prompt injection, state poisoning, misleading logs, or overwrite of trusted working files if higher-level routing or filenames are manipulated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The self-evolution feature changes future tier selection based on stored history, but the description does not clearly warn that behavior will drift over time. While not inherently malicious, undocumented adaptation can undermine predictability, auditing, and reproducibility, especially if historical data is skewed or poisoned.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The top-level tier description and related comments characterize T4 as ripgrep-based, which implies a specific implementation and performance profile. The actual code runs the 'grep' binary, so the inline documentation is factually inconsistent with what executes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module docstring states that question queries skip keyword tiers and route directly to semantic search after the cache check. However, _QUESTION_TIERS includes T5:lancedb keyword search before T5:lancedb_semantic, so the documentation actively contradicts runtime behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.