Security audit

Brain Memory System

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is purpose-aligned overall, but it needs Review because it persists broad agent memory, can send procedure history to configurable LLM endpoints, and can apply model-rewritten procedures without built-in approval.

Install only if you are comfortable with a local persistent memory database and review procedure evolution carefully. Prefer --dry-run for proc evolve, use a local or trusted LLM endpoint, avoid storing secrets in procedures/failure notes, do not put high-value API keys into brain.conf, and treat the multi-agent scope as organizational rather than a security boundary.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: scripts/evolve.py:178
Finding: Indirect prompt injection can persist attacker-controlled procedure instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/evolve.py:224
Finding: Configurable LLM endpoint can receive sensitive memory and bearer credentials
Content: View full analysis
}" local val="${2:?Usage: brain config set }" if [[ ! -f "$conf_file" ]]; then echo "# brain.conf" > "$conf_file" fi if grep -q "^$key " "$conf_file" 2>/dev/null; then sed -i "s|^$key .*|$key = $val|" "$conf_file" else echo "$key = $val" >> "$conf_file" fi ``` ### Technical Analysis The remote LLM call is part of the declared `proc evolve` functionality, and the documentation discloses that evolution data is sent externally. However, the implementation allows an unrestricted URL and attaches the configured bearer token to that destination. There is ...[truncated 1538 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/brain.sh:117
Finding: LLM API keys are stored and printed in plaintext
Content: View full analysis
}" local val="${2:?Usage: brain config set }" if [[ ! -f "$conf_file" ]]; then echo "# brain.conf" > "$conf_file" fi if grep -q "^$key " "$conf_file" 2>/dev/null; then sed -i "s|^$key .*|$key = $val|" "$conf_file" else echo "$key = $val" >> "$conf_file" fi echo "✅ Set $key = $val" ;; ``` The Python implementation then reads the secret directly from that file: ```python if os.path.exists(CONF_FILE): with open(CONF_FILE) as f: for line in f: line = line.strip() if not line or line.startswith("#"): continue if "=" in line: k, v = line.split("=", 1) k = k.strip().lower() v = v.strip().strip('"').strip("'") if k in ("key", "llm_key", "api_key"): conf["key"] = v ``` ### Technical Analysis `brain config set key ` writes the credential to `scripts/brain.conf` as plaintext. The code does not create the file atomically, enforce mode `0600`, verify ownership, or reject symbolic links. It also prints the complete key to standard output. Although `config show` masks most of the stored key, that does not protect the value during initial configuration. The plaintext may be captured by terminal logging, shell command history, CI output, backups, or another local account if the file permissions are permissive. ### Attack Path 1. A user runs `brain config set key `. 2. The secret is supplied as a command-line argument and may enter shell history or process inspection output. 3. The command prints the complete secret to the terminal. 4 ...[truncated 535 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/brain.sh:8
Finding: Caller-controlled and inconsistent agent scoping permits cross-agent access
Content: View full analysis
= ? AND date >= date('now', ?) ORDER BY importance DESC, date DESC""", (threshold, f"-{days} days") ).fetchall() ``` Shared procedures are selected through visibility scope and then mutated: ```python proc = db.execute( "SELECT * FROM procedures WHERE slug = ? AND agent IN (?, 'shared')", (slug, BRAIN_AGENT) ).fetchone() db.execute( """UPDATE procedures SET steps = ?, version = ?, updated_at = datetime('now') WHERE id = ?""", (new_steps, new_version, proc["id"]) ) ``` The legacy facts interface has no agent field or filter: ```python cursor.execute( "SELECT value, category, confidence, permanent FROM facts WHERE entity = ? AND key = ?", (entity, key) ) ``` ### Technical Analysis The multi-agent model treats `BRAIN_AGENT` as an authorization identity, bu ...[truncated 1741 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/schema.sql:72
Finding: Documented fresh-install schema is incompatible with agent-aware runtime operations
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (27)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description presents a comprehensive, unified cognitive memory system with many subsystems and capabilities. The supplied code chunk, however, is narrowly focused on one subsystem: thalamic attention filtering. It computes heuristic attention scores and optionally queries a SQLite database to penalize recently similar episode content, but it does not implement the other major declared functions such as storing/retrieving memories, fact management, procedural evolution, consolidation, or health monitoring. This is a material description-to-behavior mismatch because the declared primary purpose is substantially broader than what the code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a broad, brain-inspired unified memory system with multiple subsystems and advanced capabilities: semantic fact management, procedural memory evolution, attention filtering, sleep consolidation, and health metrics. The supplied code chunk does not implement most of those capabilities. Instead, it is a narrow database operations helper that safely inserts episodes and performs parameterized searches/listings/statistics against SQLite tables. It does touch episodic recall and can search facts/procedures, so it partially aligns with the memory theme. However, the primary behavior here is CRUD/reporting for existing DB records, not the full unified cognitive system described. The mismatch is material because several highlighted capabilities are absent, and the command surface is a db_ops.py utility rather than the described consolidated brain command.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a comprehensive, brain-inspired unified memory platform with multiple subsystems and advanced behaviors. The supplied code only covers a narrow subset: semantic fact CRUD/search against a SQLite facts.db/facts_fts schema, plus simple statistics and access-count updates. It does not implement episodic memory, procedural memory, evolution, consolidation, filtering, or health metrics as described. The code also explicitly states it queries a legacy facts.db for backward compatibility, which contradicts the claim of a unified replacement system except in a limited subcommand sense. Therefore the description materially overstates the actual behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code chunk does relate to episodic memory storage, so it is thematically adjacent to the declared memory system. However, the actual code is not the unified cognitive memory system described. It specifically implements a one-off migration utility for importing daily markdown logs into an episodes table in a SQLite database. It does not provide semantic facts, procedural memory evolution, attention filtering, sleep consolidation, soul erosion metrics, or a unified brain command interface. Its primary purpose is data migration/import, which is a materially narrower and different capability than the declared system.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad, unified memory architecture spanning several distinct subsystems and capabilities. The supplied code chunk, however, is narrowly focused on working memory management: it parses TTLs, stores transient slots in SQLite, evicts low-priority items when capacity is exceeded, and synchronizes with a markdown session-state file. While this fits a plausible 'prefrontal cortex/working memory' component of a larger system, it does not implement or expose most of the declared features. This is a material description-behavior mismatch because the actual code’s primary purpose is much narrower than the declared skill purpose.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 21)May include surrounding context.
md
## Key Feature: Procedure Evolution Procedures that **rewrite themselves** from failure patterns: 1. Record failures with step-level granularity 2. At 3+ failures, the system suggests evolution

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README promotes LLM-driven procedure self-rewriting that can modify workflows based on observed failures, but it does not warn users that generated changes may be unsafe, incorrect, or manipulable by hostile inputs in stored failure data. In an agent skill that manages operational memory and procedures, this increases the chance of unsafe autonomous workflow drift, prompt-influenced procedure corruption, or accidental insertion of dangerous steps without human review.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises capabilities that imply shell execution, filesystem access, environment-variable handling, database writes, and optional network egress to an LLM, but it declares no explicit tool scope or permissions boundary. In an agent ecosystem, this can cause the skill to be invoked with broader authority than users expect, increasing the chance of unintended file modification, secret exposure, or external data transmission.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invocation guidance is extremely broad—covering storing experiences, recalling memories, managing facts, evolving procedures, filtering information, consolidation, and health checks—which makes the skill likely to be auto-selected for many generic prompts. In an agent system, overbroad routing increases the chance this skill gains access to sensitive user context, local files, databases, or optional LLM egress when a narrower or safer skill should have been chosen.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest describes a unified cognitive memory system for storing, recalling, consolidating, and evolving memories/procedures. In this shell entrypoint, the config subcommand manages external LLM endpoint URLs and API keys, which is a distinct capability centered on configuring remote model access rather than directly performing memory operations. While LLM use is mentioned for procedural evolution, exposing generic endpoint and credential management at the CLI level is broader than the manifest's stated user-facing purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The config set command writes arbitrary values, including API keys, to brain.conf on disk and then echoes the full value back to the terminal. This can expose secrets through shell history, terminal logs, screenshots, or other local observation, and storing credentials unencrypted in a skill directory increases the chance of accidental disclosure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring states that low-value old episodes may be forgotten/archived as part of consolidation. However, in the forgetting section the code merely inserts a row into consolidation_log and explicitly comments that it does not delete or mark the episode, so the documented behavior contradicts the actual implementation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The consolidation pipeline extracts data from free-form episode content and persists it into the facts table automatically, potentially duplicating secrets, personal data, incident details, URLs, or internal versions into a second long-lived store. In a memory skill whose purpose is broad retention and recall, this increases exposure surface, makes later retrieval more likely, and can undermine data minimization or deletion expectations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The stats command runs aggregate queries over the entire database without applying the agent scope used elsewhere in the file. Any caller able to invoke this command can learn global counts, date ranges, emotion distributions, and activity patterns for other agents, which is a confidentiality and tenant-isolation failure in a multi-agent memory system.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The who command enumerates every agent present in episodes, facts, and procedures and reports per-agent record counts. In a system described as a memory store, this reveals tenant identities and metadata unrelated to the caller's authorized scope, enabling reconnaissance about other users or agents even if direct record access is otherwise restricted.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/evolve.py (reported line 31)May include surrounding context.
python
# BRAIN_LLM_MODEL — Model name to use for evolution # # Supported providers (just point URL + key at any OpenAI-compatible API): # - OpenAI: https://api.openai.com/v1/chat/completions + OPENAI_API_KEY # - Anthropic: (via proxy) # - Google: https://generativelanguage.googleapis.com/v1beta/openai/chat/completions + BRAIN_LLM_KEY # - Ollama: http://localhost:11434/v1/chat/completions (no key needed)

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Failure descriptions and fix_applied fields are treated as trusted context and fed back into the LLM, which then rewrites stored procedures. An attacker who can record crafted failures or fixes can gradually poison procedure evolution, causing harmful, misleading, or insecure steps to be persisted for future runs.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The evolve path sends full procedure content plus failure history and fixes to a configurable remote LLM endpoint. That creates a real confidentiality and trust-boundary issue: procedures, operational errors, and remediation notes may contain sensitive internal details and are transmitted off-host without minimization or strong allowlisting of destinations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script performs network transmission of procedure data to an external LLM without an explicit user-facing notice at runtime. In a memory/procedure tool, users may reasonably expect local handling, so silent upload of history and fixes increases privacy, compliance, and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code opens a SQLite database and inserts episode records derived from markdown daily logs, which likely contain personal or sensitive content. Although the script has a generic module docstring, it does not provide a user-facing warning or confirmation before persisting that data to the database in non-dry-run mode.
Content: No source excerpt is available for this finding.

Tainted flow: 'SESSION_STATE' from os.environ.get (line 26, credential/environment) → open (file write)

Medium

Category: Data Flow
Confidence: 95% confidence
Finding: The script takes SESSION_STATE directly from an environment variable and uses it as a write path without validation. An attacker who can influence the environment can redirect writes to arbitrary files accessible to the process, causing file overwrite, data corruption, or clobbering of other application state; the risk is increased because this skill is explicitly designed to persist and sync memory state automatically.
Content: Scanner excerpt · scripts/working_memory.py (reported line 285)May include surrounding context.
python
output = "\n".join(lines) with open(SESSION_STATE, "w") as f: f.write(output) print(f"✅ Dumped {len(rows)} working memory slots to SESSION-STATE.md")

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes cognitive memory features like episodic, semantic, procedural, attention, consolidation, and health metrics, but does not mention reading from or writing to a separate markdown session-state file. The wm help text and dispatcher explicitly support load, dump, and sync operations with SESSION-STATE.md, which is an extra integration capability beyond the declared purpose of the brain database/CLI.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The printed summary implies the forgetting/archive step changed episode state. But the only write in that path is to consolidation_log, and the nearby comment confirms the code does not actually archive the episodes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code path inserts user-supplied content into the SQLite database and commits it, which is a file-backed data write. While the module docstring describes database operations generally, this command lacks a user-facing warning or disclosure that the provided content will be persisted to the local brain database.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The cmd_recall docstring says 'Search all memory,' which implies unrestricted search across the brain. In practice, the function filters by agent_scope() to own+shared entries, so the inline documentation overstates what the command actually returns.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.