Security audit

brainmd

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly designed to create persistent self-modifying agent behavior, but it lacks enough scoping and safeguards for unattended use.

Install only if you deliberately want a persistent agent-behavior memory. Keep the brain directory private, review and back up pathways.json before enabling heartbeat or cron, avoid putting raw notes or untrusted pathway text into system/developer prompts, and require manual approval for pruning or for new pathways that will influence future actions.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

Location: scripts/cortex-review.js:128
Finding: Persistent Agent Memory Poisoning Through Untrusted Pathway Content
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: A description-behavior mismatch is dangerous because users and orchestration systems may trust the declared purpose while the actual behavior differs, especially when the skill performs autonomous review and file mutation. Even if the mismatch here may stem from packaging or implementation drift, it can cause operators to enable the skill under false assumptions about what it really does and what state it persists.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 95% confidence
Finding: The core design is self-modification: the agent is instructed to strengthen, weaken, decay, and prune behavioral pathways based on runtime outcomes, with persistent storage across sessions. Self-modifying behavior is inherently risky because it changes future decision-making in ways that may be hard to audit, can be influenced by adversarial or low-quality inputs, and may train away safety-relevant behaviors unless carefully constrained.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: brainmd description: "Neuroplastic self-modifying runtime for AI agents. Creates a file-based 'brain' that learns from interactions: reflexes (fast-path responses), habits (learned patterns), weighted pathways (reinforcement), and a cortex (self-review loop). Use when: setting up adaptive agent behavior, creating learning loops, building persistent behavioral memory, or making an agent that improves over time." --- # brainmd

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · scripts/init-brain.sh (reported line 52)May include surrounding context.
sh
* Reflex: Timing decisions * Should I notify the user right now? * * Self-modifying: thresholds adjust based on feedback. * * Usage: * node timing.js check [urgency] — should I notify? (urgency 0.0-1.0)

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · scripts/reflex-timing.js (reported line 6)May include surrounding context.
js
* Reflex: Timing decisions * Should I notify the user right now? * * Self-modifying: thresholds adjust based on feedback. * * Usage: * node timing.js check [urgency] — should I notify? (urgency 0.0-1.0)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README explicitly instructs users to run a periodic self-review loop that mutates weights and can prune pathways, but it does not clearly warn that this process will automatically modify persistent files and delete entries when weights hit zero. In a self-modifying agent skill, that omission is security-relevant because operators may enable unattended cron/heartbeat execution without understanding the persistence, mutation, and pruning behavior affecting agent state.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to run shell and Node commands that read and mutate persistent files, but it declares no tool scope or allowed-tools restrictions. This creates an unnecessary trust gap: a broadly-invoked skill can gain shell-capable behavior without any explicit permission boundary, increasing the chance of unintended execution in sensitive workspaces.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invocation guidance is extremely broad ('adaptive agent behavior', 'learning loops', 'persistent behavioral memory', 'making an agent that improves over time'), so the skill may be pulled into many ordinary sessions. Because the skill promotes self-modification and persistent behavioral state, overbroad activation materially increases the chance of inappropriate use, state poisoning, or unsafe autonomous changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The HEARTBEAT instructions tell the agent to run self-review and status commands automatically on every heartbeat and to record outcomes continuously, without clear limits or approval gates. In context, this is more dangerous than a normal broad trigger because it normalizes autonomous, repeated mutation of long-lived behavior files, which can amplify mistakes, entrench bad patterns, and create persistence from transient prompts or attacker-influenced interactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code permanently removes entries from the pathways data store via delete data.pathways[id]. Although the file header and CLI usage mention that prune removes low-weight pathways, the destructive action itself has no confirmation prompt or cautionary warning that data will be deleted irreversibly.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.