T07 · Tool Hijacking and Spoofing
Error
- Location
ai_memory_protocol_v1.2.1.py:2584- Finding
Broad Agent API Hijacking and Destructive Method Restoration
- Content
View full analysis
- Remediation
View remediation
Security audit
MAMP
Security checks for vulnerabilities and agentic risk
Overview
This local memory skill is not clearly malicious, but it needs review because automatic recording can intercept too much data and the storage behavior does not match the documentation.
Install only after reviewing and constraining it. Use an explicit per-agent database path in a protected directory, avoid auto_record unless you accept broad runtime interception, do not store secrets in conversations, and review/delete the SQLite database and any WAL/SHM sidecar files as sensitive plaintext records.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
other
Warning
- Location
ai_memory_protocol_v1.2.1.py:139- Finding
Automatic Collection and Persistence of Host Environment Information
- Content
View full analysis
Dict[str, Any]: """ Detect current platform and environment. Returns a dict with os_name, os_version, hostname, container, arch, python_version, and python_executable. """ result: Dict[str, Any] = {} system = platform_module.system().lower() if system == "linux": result["os_name"] = "linux" result["os_version"] = platform_module.release() or "unknown" elif system == "windows": result["os_name"] = "windows" result["os_version"] = platform_module.release() or "unknown" elif system == "darwin": result["os_name"] = "macos" result["os_version"] = platform_module.mac_ver()[0] or "unknown" else: result["os_name"] = system result["os_version"] = "unknown" result["arch"] = platform_module.machine().lower() result["python_version"] = platform_module.python_version() result["python_executable"] = sys.executable or "unknown" try: result["hostname"] = socket.gethostname() except Exception: result["hostname"] = "unknown" result["container"] = False if system == "linux": container_hints = [ "/.dockerenv", "/run/.containerenv", "/proc/1/cgroup", ] for hint in container_hints: if os.path.exists(hint): result["container"] = True break if not result["container"]: try: with open("/proc/1/cgroup", "r") as f: cgroup_content = f.read().lower() if any(x in cgroup_content for x in [ "docker", "containerd", "cri", "kubepod" ]): result["container"] = True ...[truncated 2463 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
ai_memory_protocol_v1.2.1.py:202- Finding
Undeclared Writes to Deployment-Specific System Paths
- Content
View full analysis
str: """ Platform-aware default DB path. Respects MARK_MEMORY_DB env var; otherwise uses: - container: /opt/claw/hermes/protocol/mark_memory.db - host: /vol2/1000/claw/hermes/protocol/mark_memory.db """ env_path = os.environ.get("MARK_MEMORY_DB", "") if env_path: return env_path return str(_platform_protocol_dir() / "mark_memory.db") def _platform_protocol_dir() -> Path: """ Return platform-aware protocol directory. - container: /opt/claw/hermes/protocol/ - host: /vol2/1000/claw/hermes/protocol/ """ if _PLATFORM_INFO.get("container", False): return Path("/opt/claw/hermes/protocol") return Path("/vol2/1000/claw/hermes/protocol") ``` ```python # Default DB path — uses platform-aware resolver DEFAULT_DB_PATH = _platform_default_db_path() # Paths — use platform-aware protocol directory, no system paths _PROTOCOL_DIR = _platform_protocol_dir() LOCK_PATH = str(_PROTOCOL_DIR / "session_gc.lock") LOG_PATH = str(_PROTOCOL_DIR / "session_gc.log") AUDIT_PATH = str(_PROTOCOL_DIR / "session_gc_audit.log") ``` `SKILL.md:66-71` instead states: ```markdown **Default behavior — local directory only:** - DB file written to `./mark_memory.db` in the current working directory - No system directories are touched - No log files, audit files, or hidden state files are written - No network access, no external services ``` ### Technical Analysis The implementation defaults to fixed deployment-specific paths under `/opt` or `/vol2`, while the security documentation promises a database in the current directory and states that no system directories are touched. This violates the documented filesystem trust boundary. If the host process h ...[truncated 1507 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
ai_memory_protocol_v1.2.1.py:407- Finding
Plaintext Conversation Storage Without Enforced Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (56)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Persisting platform and environment fingerprinting data, importing external JSON, and using module scanning/monkey-patching goes far beyond the stated purpose of a local conversation memory tool. In this context, the skill becomes more dangerous because it stores host metadata alongside plaintext conversation history and may silently intercept agent communications, creating privacy and reconnaissance risk on multi-agent or shared systems.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Persisting platform and environment fingerprinting data, importing external JSON, and using module scanning/monkey-patching goes far beyond the stated purpose of a local conversation memory tool. In this context, the skill becomes more dangerous because it stores host metadata alongside plaintext conversation history and may silently intercept agent communications, creating privacy and reconnaissance risk on multi-agent or shared systems.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Persisting platform and environment fingerprinting data, importing external JSON, and using module scanning/monkey-patching goes far beyond the stated purpose of a local conversation memory tool. In this context, the skill becomes more dangerous because it stores host metadata alongside plaintext conversation history and may silently intercept agent communications, creating privacy and reconnaissance risk on multi-agent or shared systems.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Persisting platform and environment fingerprinting data, importing external JSON, and using module scanning/monkey-patching goes far beyond the stated purpose of a local conversation memory tool. In this context, the skill becomes more dangerous because it stores host metadata alongside plaintext conversation history and may silently intercept agent communications, creating privacy and reconnaissance risk on multi-agent or shared systems.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented passive auto-record feature describes broad capture of agent message content without requiring explicit per-call invocation. For a memory skill, this materially expands data collection semantics and increases the chance that sensitive conversations are stored unexpectedly.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill advertises a SQLite-only persistent memory store, but the auto_record feature silently hooks loaded modules to capture message data. That mismatch is dangerous because integrators may grant trust based on the manifest while the implementation performs broader surveillance-style behavior than expected.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Inspecting sys.modules and mutating discovered callables changes runtime behavior outside the memory component's boundary. This can interfere with other modules, create hard-to-audit side effects, and turn a local storage utility into a generalized instrumentation mechanism for agent communications.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Auto-record passively captures conversational content without any visible prompt, consent flow, or runtime warning. In an agent skill handling potentially sensitive chats, silent collection materially increases privacy risk and can violate least surprise and data-minimization expectations.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The implementation performs broad conversational capture by scanning modules, identifying send-like methods by name, and recording the first string argument. This heuristic collection is overbroad, error-prone, and capable of capturing unrelated or sensitive data from other loaded components.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is presented as SQLite-only local session memory, but the auto_record feature silently performs runtime-wide passive interception by wrapping message-sending methods. That mismatch is security-relevant because users and integrators may grant this skill access under a much narrower trust assumption than the code actually requires, leading to covert overcollection of prompts, responses, and possibly sensitive data.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code enumerates sys.modules, inspects attributes, and monkey-patches methods on matching objects based on broad name heuristics like hermes, mark, and agent. For a local memory storage skill, this is an unjustified privilege expansion that enables stealthy interception and modification of runtime behavior well beyond simple persistence.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The auto-record feature enables passive capture of outbound and inferred user/assistant message content without any visible warning, consent, or activation ceremony beyond a constructor flag. In an agent environment, this can silently persist sensitive prompts, secrets, personal data, or internal workflow content, making the feature materially more dangerous than ordinary memory storage.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The method-wrapping logic is purpose-built to scan modules, infer likely messaging methods, extract string arguments, and store them automatically in durable memory. This is dangerous because it creates a covert collection channel that can capture both user and agent content across the runtime, including unrelated or sensitive communications, without explicit invocation of the memory API.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is presented as local SQLite memory, but it also scans loaded modules and wraps likely messaging methods to passively capture outbound text. That materially expands scope from explicit local storage to covert interception of host-agent communications, violating least surprise and enabling collection of sensitive prompts, replies, or user data without direct calls to the memory API.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Passive auto-recording stores message content without any user-facing warning or consent mechanism in the code path. Because the capture is automatic and heuristic-based, users and operators may be unaware that arbitrary message text is being persisted, including sensitive or regulated data.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Auto-record scans modules, identifies probable messaging methods by name heuristics, wraps them, and stores encountered text automatically. In context, this amounts to broad covert logging of natural-language content across the host environment, with weak scoping and no minimization, making accidental collection of secrets, personal data, or unrelated conversations likely.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Runtime monkey-patching of host modules is dangerous because it modifies behavior of unrelated components at runtime and can silently intercept conversational content. In an agent skill, this creates a hidden data-capture path and increases the blast radius to any loaded module whose name matches heuristic patterns like 'hermes', 'mark', or 'agent'.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Automatic passive capture wraps likely message-sending methods and stores outbound content without a clear user-facing notice at collection time. In a memory skill, this is especially dangerous because captured conversations are retained, searchable, and exportable, increasing the chance of silent retention of secrets, personal data, or regulated content.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The auto-record feature monkey-patches methods across loaded modules to passively capture message content without explicit per-target consent. This creates a broad interception mechanism for user and agent communications, enabling stealthy collection of sensitive data and unpredictable interference with application behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly markets persistent, searchable cross-session memory but does not warn that conversation contents are stored on disk, which can include sensitive prompts, secrets, personal data, or proprietary information. In an AI-agent context, users may assume ephemeral handling, so the missing disclosure increases the risk of unintentional sensitive-data retention and later exposure through local access, backups, or forensic recovery.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Auto-record mode is described as a convenience feature without a clear warning that it automatically captures conversation turns, which can cause silent collection of sensitive or regulated data. In agent workflows, automatic capture is more dangerous because operators may enable it for convenience and unintentionally persist all prompts and responses without informed consent or process controls.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares no explicit tool scope or permissions even though its documented usage clearly involves reading environment variables and writing a local SQLite database file. Missing permission disclosure weakens reviewability and can cause an agent framework to grant broader capabilities than users expect, especially for a persistence-oriented skill handling plaintext conversation history.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Beyond storing and searching memory, the implementation can archive and permanently delete sessions in bulk. Those destructive administrative capabilities materially expand the behavior beyond a plain persistent/searchable memory store as described in the manifest.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The bulk_delete() method permanently deletes memory and session records for the provided session IDs, but there is no confirmation prompt, user-facing log, or warning comment/docstring indicating that this operation is destructive. Because this file itself also removes operational logging via no-op _gc_log/_gc_audit helpers, callers have no built-in disclosure that data will be irreversibly removed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
split_session() copies turns at and after the split point into a new session and then deletes those turns from the original session with DELETE FROM memory, making the operation materially destructive to the source session. The function includes no confirmation step, no user-visible logging, and no warning in its docstring that the source session will be mutated.
- Content